ad2app-lib 1.11.0 → 1.15.0

package/dist/legal/meta.d.ts

@@ -1,5 +1,5 @@
 export declare const LEGAL_META: {
-    readonly lastUpdated: "10 June 2026";
+    readonly lastUpdated: "6 July 2026";
     readonly contactEmail: "kontakt@ad2.app";
     readonly controllerName: "Ad2app sp. z o.o.";
     readonly controllerAddress: "ul. Juliana Smulikowskiego 4A/21, 00-389 Warszawa, Poland";

package/dist/legal/meta.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LEGAL_META = void 0;
 exports.LEGAL_META = {
-    lastUpdated: '10 June 2026',
+    lastUpdated: '6 July 2026',
     contactEmail: 'kontakt@ad2.app',
     controllerName: 'Ad2app sp. z o.o.',
     controllerAddress: 'ul. Juliana Smulikowskiego 4A/21, 00-389 Warszawa, Poland',

package/dist/legal/privacy.js

@@ -15,7 +15,7 @@ exports.PRIVACY_SECTIONS = [
         id: 's2',
         title: '2. Scope of This Policy',
         blocks: [
-            { kind: 'p', text: 'This Privacy Policy explains how we collect, use, store, share, and protect personal data when you access or use the ad2app platform — including our website, web application, and any related services (collectively, the "Service"). It applies to all users: brands, agencies, and influencers who register accounts, as well as individuals who submit their email via our waitlist form.' },
+            { kind: 'p', text: 'This Privacy Policy explains how we collect, use, store, share, and protect personal data when you access or use the ad2app platform, including our website, web application, our MCP integration for third-party tools, and any related services (collectively, the "Service"). It applies to everyone who registers an account to schedule and publish social media content.' },
             { kind: 'p', text: 'We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and the Polish Act of 10 May 2018 on the Protection of Personal Data.' },
             { kind: 'p', text: 'In fulfilling our accountability obligations under Art. 5(2) GDPR, ad2app maintains a Record of Processing Activities (ROPA) as required by Art. 30 GDPR, available to supervisory authorities on request.' },
         ],
@@ -28,10 +28,10 @@ exports.PRIVACY_SECTIONS = [
             {
                 kind: 'ul',
                 items: [
-                    { text: '**Identity & contact data:** first name, last name, email address, business name, phone number (if provided).' },
-                    { text: '**Account credentials:** hashed password; OAuth access and refresh tokens when you connect social media accounts — we store tokens, not your passwords.' },
+                    { text: '**Identity and contact data:** first name, last name, email address, phone number (if provided).' },
+                    { text: '**Account credentials:** hashed password. See "OAuth tokens and account connections" below for how connection credentials are handled.' },
                     {
-                        text: '**Social platform data via OAuth:** when you authorise a connection to one of the social media platforms you choose to connect (currently Instagram, TikTok, X (Twitter), YouTube, LinkedIn, Facebook, Threads, Pinterest, Reddit, and Bluesky), we receive data from that platform\'s API as permitted by your OAuth consent. Across all connected platforms this generally includes your account/profile data (such as user ID, username or handle, display name, avatar, and account statistics where the platform exposes them), the content and media of posts you compose, schedule, or publish through the Service, and performance/analytics data for your published posts. The specific data received depends on the platform and the permissions you grant. For some platforms we describe the data in more detail below; the absence of a platform from the detailed list does not mean less data protection — the same general categories and safeguards apply:',
+                        text: '**Social platform data via OAuth:** when you authorise a connection to one of the social media platforms you choose to connect (currently Instagram, TikTok, X (Twitter), YouTube, LinkedIn, Facebook, Threads, Pinterest, Reddit, and Bluesky), we receive data from that platform\'s API as permitted by your OAuth consent. Across all connected platforms this generally includes your account/profile data (such as user ID, username or handle, display name, avatar, and account statistics where the platform exposes them), the content and media of posts you compose, schedule, or publish through the Service, and performance/analytics data for your published posts. The specific data received depends on the platform and the permissions you grant. For some platforms we describe the data in more detail below:',
                         sub: [
                             { text: '**TikTok:** basic profile (user ID, display name, avatar, biography, profile URL), account statistics (follower count, following count, like count, video count), video list and metadata (titles, view counts, engagement metrics), and — where enabled for scheduling features — video upload and publish permissions. We request only the permissions required for the features you actively use.' },
                             { text: '**Instagram:** Instagram Business account data including username, biography, profile picture, account type, and associated business metrics.' },
@@ -40,17 +40,16 @@ exports.PRIVACY_SECTIONS = [
                             { text: '**Other connected platforms (X (Twitter), LinkedIn, Threads, Pinterest, Reddit, Bluesky):** account/profile data, the post content and media you publish through the Service, and published-post analytics, in each case as permitted by the OAuth permissions you grant on that platform.' },
                         ],
                     },
+                    { text: '**OAuth tokens and account connections:** publishing to your connected platforms is handled by our processor Zernio (see Section 6). For the platforms Zernio publishes to, we do not store your OAuth tokens ourselves; the tokens are held by Zernio on our behalf, and we hold only a reference to your connected account (platform name and username). For a small number of platforms where we read analytics directly (TikTok, Instagram, YouTube, Facebook), we may hold an access token ourselves. We are completing a technical review to confirm and, where needed, encrypt at rest every token we hold directly (see Section 10).' },
                     { text: '**Audience data (aggregate only):** demographic and engagement statistics about your social media audience, as provided by the connected platform\'s API. This data is processed exclusively in aggregate statistical form and is not linked to any identified individual within your audience. We have assessed whether this data could constitute special category data under Art. 9 GDPR and confirm that we do not process such special category data — audience data is processed solely as aggregate numeric metrics.' },
                     { text: '**Inbox data:** when you use the platform\'s inbox features, direct message conversations and post comments from your connected social media accounts are fetched and displayed. This includes content sent to you by your followers or other third parties on those platforms. See Section 11 for further detail.' },
-                    { text: '**Professional data:** influencer category, social media handles, media kit content.' },
-                    { text: '**Campaign & collaboration data:** campaign briefs, offer terms, messages exchanged within the platform between brands and influencers.' },
-                    { text: '**Post content & scheduled posts:** the content you compose, schedule, and publish through the Service — including post text, captions, hashtags, links, scheduling times, and the images, videos, and other media you upload for those posts — together with the publishing status and metadata of each post.' },
+                    { text: '**Post content and scheduled posts:** the content you compose, schedule, and publish through the Service, including post text, captions, hashtags, links, scheduling times, and the images, videos, and other media you upload for those posts, together with the publishing status and metadata of each post. Where we cache a thumbnail or media preview for display in the app, we store only a pointer (a URL) to the file hosted by Zernio; we do not copy the underlying media into our own storage.' },
                     { text: '**Published-post analytics:** performance and engagement metrics for posts you have published through the Service to your connected accounts (e.g. views, impressions, likes, comments, shares, reach, and other statistics), as provided by the connected platform\'s API.' },
-                    { text: '**Media & content:** files you upload (images, videos, documents) for posts, campaigns, or your profile.' },
+                    { text: '**Media and content:** files you upload (images, videos, documents) for posts or your profile.' },
                     { text: '**Technical & usage data:** anonymised IP address, browser type and version, operating system, pages visited, referral URLs, timestamps, error and crash reports, and usage events (e.g. feature interactions such as button clicks and page views, tracked via PostHog — see Sections 6 and 9). Usage tracking starts only after you give consent via the cookie banner.' },
-                    { text: '**Session replay data:** with your consent (see Section 9), we record replays of your interactions with the Service (mouse movement, scrolling, clicks, page navigation) to diagnose usability problems and errors. All text you type into input fields is masked before recording and never leaves your browser in readable form. Recordings are retained for 30 days.' },
-                    { text: '**Billing data:** billing address and payment reference. Payment card details are handled exclusively by Stripe and are never stored by ad2app.' },
-                    { text: '**Waitlist data:** if you submit your email address via our waitlist form before registering, we store that email address to notify you when access is available.' },
+                    { text: '**Session replay data:** with your consent (see Section 9), we record replays of your interactions with the Service (mouse movement, scrolling, clicks, page navigation) to diagnose usability problems and errors. Values you type into form fields are masked before recording. We are extending this masking to also cover other user-authored text shown on screen during a recording (for example post captions or inbox messages displayed as read-only text); until that work is complete, such text may appear in a recording in readable form. Recordings are automatically deleted after 30 days.' },
+                    { text: '**Billing data:** Stripe, our payment processor, collects and holds your billing address and payment details when you subscribe. We ourselves store only a reference to your Stripe customer and subscription records (not your card details or billing address).' },
+                    { text: '**Marketing email preference:** whether you have opted in to marketing and lifecycle emails, and when (see Section 4). This preference is opt-in only — it is never pre-selected on your behalf — and you can withdraw it at any time via the unsubscribe link in any such email or by contacting us at {EMAIL}.' },
                     { text: '**Feedback data:** free-text feedback submitted via the in-app feedback form. This may incidentally contain personal data you choose to include.' },
                 ],
             },
@@ -66,22 +65,20 @@ exports.PRIVACY_SECTIONS = [
                 kind: 'table',
                 headers: ['Purpose', 'Legal basis (GDPR Art. 6)'],
                 rows: [
-                    ['Creating and managing your account', 'Art. 6(1)(b) — performance of contract'],
-                    ['Providing platform features (scheduling and publishing posts to your connected accounts, post analytics, campaigns, collaborations, messaging, inbox)', 'Art. 6(1)(b) — performance of contract'],
-                    ['Processing social media data received via OAuth connections (profile/account data, post content and media you publish, published-post analytics, audience metrics, engagement data, video metadata, inbox messages)', 'Art. 6(1)(b) — performance of contract: necessary to deliver post scheduling and publishing, post analytics, influencer-brand matching, campaign analytics, and inbox features as contracted. Audience data is processed in aggregate and anonymised form only. No Art. 9 special category data is processed.'],
-                    ['Automated influencer–campaign matching and recommendations (profiling within the meaning of Art. 4(4) GDPR)', 'Art. 6(1)(b) — performance of contract. No binding automated decision with legal or similarly significant effect is made solely by automated means — all matches require affirmative acceptance by both parties. Human review is available on request.'],
-                    ['Temporary retention of account data for 30 days following account deletion (account recovery window)', 'Art. 6(1)(f) — legitimate interests: ad2app\'s and the user\'s shared interest in preventing irreversible accidental data loss, balanced against the minimal additional retention period.'],
-                    ['Processing payments and issuing invoices (via Stripe)', 'Art. 6(1)(b) & Art. 6(1)(c) — contract & legal obligation'],
-                    ['Complying with legal obligations (tax, accounting, record-keeping)', 'Art. 6(1)(c) — legal obligation: Polish Accounting Act (Ustawa o rachunkowości), Tax Ordinance (Ordynacja podatkowa), VAT Act (Ustawa o VAT).'],
-                    ['Waitlist email: notifying you when platform access is available', 'Art. 6(1)(a) — consent (given at the point of waitlist submission; withdrawable at any time).'],
-                    ['Processing in-app feedback', 'Art. 6(1)(f) — legitimate interests: ad2app\'s interest in improving the Service through user feedback.'],
-                    ['Improving and developing the Service (usage analytics, session replay, and error tracking via PostHog)', 'Art. 6(1)(a) — consent, given via the cookie consent banner and withdrawable at any time. No analytics events are captured and no analytics cookies are set before you make a choice. Supplemented by Art. 6(1)(f) — legitimate interests — for aggregate, pseudonymised product statistics.'],
-                    ['Security, fraud prevention, and abuse detection', 'Art. 6(1)(f) — legitimate interests: ad2app\'s interest in maintaining platform integrity and protecting users from harm, which overrides the minimal intrusiveness of security logging.'],
-                    ['Transfer of personal data in a merger, acquisition, or business asset sale', 'Art. 6(1)(f) — legitimate interests: ad2app\'s legitimate interest in completing lawful business restructuring, balanced against data subjects\' interests. Data subjects will be notified before their data is subject to a materially different privacy policy.'],
-                    ['Sending marketing communications', 'Art. 6(1)(a) — consent (withdrawable at any time without affecting prior processing).'],
+                    ['Creating and managing your account', 'Art. 6(1)(b), performance of contract'],
+                    ['Providing platform features (scheduling and publishing posts to your connected accounts, post analytics, inbox, the MCP integration for tools you authorize)', 'Art. 6(1)(b), performance of contract'],
+                    ['Processing social media data received via OAuth connections (profile/account data, post content and media you publish, published-post analytics, audience metrics, engagement data, video metadata, inbox messages)', 'Art. 6(1)(b), performance of contract: necessary to deliver post scheduling and publishing, post analytics, and inbox features as contracted. Audience data is processed in aggregate and anonymised form only. No Art. 9 special category data is processed.'],
+                    ['Temporary retention of account data for 30 days following account deletion (account recovery window)', 'Art. 6(1)(f), legitimate interests: ad2app\'s and the user\'s shared interest in preventing irreversible accidental data loss, balanced against the minimal additional retention period. You may waive the window and request immediate permanent deletion at {EMAIL}.'],
+                    ['Processing payments and issuing invoices (via Stripe)', 'Art. 6(1)(b) & Art. 6(1)(c), contract & legal obligation'],
+                    ['Complying with legal obligations (tax, accounting, record-keeping)', 'Art. 6(1)(c), legal obligation: Polish Accounting Act (Ustawa o rachunkowości), Tax Ordinance (Ordynacja podatkowa), VAT Act (Ustawa o VAT).'],
+                    ['Processing in-app feedback', 'Art. 6(1)(f), legitimate interests: ad2app\'s interest in improving the Service through user feedback.'],
+                    ['Improving and developing the Service (usage analytics, session replay, and error tracking via PostHog)', 'Art. 6(1)(a), consent, given via the cookie consent banner and withdrawable at any time. No analytics events are captured and no analytics cookies are set before you make a choice. Supplemented by Art. 6(1)(f), legitimate interests, for aggregate, pseudonymised product statistics.'],
+                    ['Security, fraud prevention, and abuse detection', 'Art. 6(1)(f), legitimate interests: ad2app\'s interest in maintaining platform integrity and protecting users from harm, which overrides the minimal intrusiveness of security logging.'],
+                    ['Transfer of personal data in a merger, acquisition, or business asset sale', 'Art. 6(1)(f), legitimate interests: ad2app\'s legitimate interest in completing lawful business restructuring, balanced against data subjects\' interests. Data subjects will be notified before their data is subject to a materially different privacy policy.'],
+                    ['Sending marketing and lifecycle emails (for example onboarding tips, feature announcements, and upgrade suggestions)', 'Art. 6(1)(a), consent, given by an optional, affirmative opt-in choice that is never pre-selected on your behalf, and withdrawable at any time via the unsubscribe link included in every such email or by contacting us at {EMAIL}. Withdrawal does not affect the lawfulness of prior processing. Transactional emails (account verification, security notices, billing receipts) are sent under Art. 6(1)(b) and are not affected by this preference.'],
                 ],
             },
-            { kind: 'note', label: 'Data Protection Impact Assessment (Art. 35 GDPR)', text: 'ad2app has conducted a pre-screening assessment of its processing activities against the criteria of Art. 35(1) GDPR. The automated influencer–campaign matching function involves profiling of natural persons based on professional and behavioural data. We have assessed whether this constitutes "systematic and extensive evaluation… on which decisions are taken that produce legal or similarly significant effects" within the meaning of Art. 35(3)(b). Our assessment concluded that because no decision with legal or similarly significant effect is produced solely by automated means — all campaign offers require affirmative acceptance by both parties — a full DPIA is not mandated at this stage. This assessment is documented in accordance with our accountability obligations under Art. 5(2) GDPR and is reviewed annually. We will conduct a full DPIA if the nature or scope of our profiling activities changes materially.' },
+            { kind: 'note', label: 'Data Protection Impact Assessment (Art. 35 GDPR)', text: 'We have assessed our processing activities against the criteria of Art. 35(1) GDPR and concluded that a full Data Protection Impact Assessment is not currently mandated. This assessment is documented under our Art. 5(2) accountability obligations and reviewed annually, and will be revisited if the nature or scope of our processing changes materially.' },
         ],
     },
     {
@@ -92,21 +89,21 @@ exports.PRIVACY_SECTIONS = [
             {
                 kind: 'ul',
                 items: [
-                    { text: '**Account data:** for the duration of your account plus 30 days after deletion (account recovery window), then permanently deleted. You may request immediate permanent deletion — waiving the recovery window — by explicitly stating this in your request to kontakt@ad2.app.' },
-                    { text: '**Campaign & collaboration data:** for the duration of your account plus 12 months after account deletion to allow dispute resolution, after which it is permanently deleted. Anonymised aggregated analytics may be retained indefinitely.' },
-                    { text: '**Post content, scheduled posts, and published-post analytics:** retained for the duration of your account and deleted with your account data (subject to the 30-day account recovery window). Anonymised aggregated analytics may be retained indefinitely.' },
-                    { text: '**OAuth access and refresh tokens:** revoked and deleted immediately upon disconnection or account deletion, with a maximum retention of 24 hours for revocation processing logs.' },
-                    { text: '**Inbox data (DMs and comments):** retained for the duration of your account; deleted with your account data.' },
+                    { text: '**Account data:** for the duration of your account plus a 30-day recovery window after you delete it. During the window your account is deactivated and your data (profile, scheduled posts, drafts, settings, analytics history) is held solely so the account can be restored if the deletion was a mistake. After 30 days a scheduled job permanently and irreversibly purges it. You may request immediate permanent deletion, waiving the recovery window, by explicitly stating this in a request to {EMAIL}.' },
+                    { text: '**What is immediate and irreversible even during the recovery window:** when you delete your account, we immediately disconnect your connected social accounts and revoke the associated access at our publishing processor Zernio. This is not undone by recovering your account; if you restore your account within the 30 days, your ad2app data comes back but you must reconnect your social platforms yourself.' },
+                    { text: '**What account deletion does not do:** deleting your ad2app account does not delete the posts you already published to your social media platforms; that content lives on those platforms under their terms, and you manage or delete it there. Our deletion and revocation requests to Zernio (including removal of the profile container Zernio maintains for your account) are sent immediately; if a request fails we retry it until it succeeds, so completion on Zernio\'s side can lag briefly behind your deletion. Once our disconnect and deletion requests reach Zernio, our data processing agreement with them requires deletion of all copies within 10 business days of the cessation of the relevant services, with written certification of completion.' },
+                    { text: '**Post content, scheduled posts, and published-post analytics:** retained for the duration of your account and deleted with your account data (subject to the 30-day recovery window above). Anonymised aggregated analytics may be retained indefinitely.' },
+                    { text: '**OAuth tokens:** for platforms where Zernio holds your tokens on our behalf, disconnecting an account or deleting your ad2app account triggers an immediate disconnect and revocation request to Zernio (with retries on failure, as above). Any tokens we hold ourselves are deleted immediately on disconnect or account deletion, with no recovery window.' },
+                    { text: '**Inbox data (DMs and comments):** retained for the duration of your account; deleted with your account data (subject to the 30-day recovery window).' },
                     { text: '**Invoices and billing records:** 5 years from the end of the fiscal year (Polish Accounting Act).' },
                     { text: '**Technical logs:** up to 90 days.' },
                     { text: '**Product analytics events (PostHog):** retained in pseudonymised form for the operation of our analytics; deleted within 30 days of an erasure request or consent withdrawal.' },
                     { text: '**Session replay recordings (PostHog):** 30 days, then automatically deleted.' },
-                    { text: '**Marketing consent records:** until consent is withdrawn plus 3 years for compliance evidence.' },
-                    { text: '**Waitlist emails:** until you register for an account or request deletion, or 24 months from submission if you do not register — whichever comes first.' },
+                    { text: '**Marketing consent records:** we keep a record of when you gave or withdrew marketing-email consent for as long as your account exists plus 3 years, as evidence of compliance.' },
                     { text: '**In-app feedback:** up to 24 months from submission.' },
                 ],
             },
-            { kind: 'p', text: 'Data processed solely on the basis of consent (marketing, analytics cookies, waitlist) is deleted within 30 days of consent withdrawal. Data processed for contractual performance is retained for the duration of the contract plus the applicable limitation period under Polish law (generally 3 years for commercial claims under Art. 118 of the Civil Code, or 6 years for documented claims). Data retained for legal obligation compliance follows the statutory schedule above.' },
+            { kind: 'p', text: 'Data processed solely on the basis of consent (analytics cookies, marketing emails) is deleted or ceases to be processed within 30 days of consent withdrawal. Data processed for contractual performance is retained for the duration of the contract plus the applicable limitation period under Polish law (generally 3 years for commercial claims under Art. 118 of the Civil Code, or 6 years for documented claims). Data retained for legal obligation compliance follows the statutory schedule above.' },
         ],
     },
     {
@@ -117,30 +114,43 @@ exports.PRIVACY_SECTIONS = [
             {
                 kind: 'ul',
                 items: [
-                    { text: '**Other platform users:** when you actively participate in a collaboration, your professional profile (name, social handles, media kit) is visible to the brands/agencies you are matched with, and vice versa.' },
                     {
-                        text: '**Service providers (data processors)** — engaged under contractual terms that include data protection obligations; we are in the process of formalising written Data Processing Agreements under Art. 28 GDPR with all sub-processors where not yet in place:',
+                        text: '**Service providers (data processors)** — engaged under contractual terms that include data protection obligations. A signed Data Processing Agreement (Art. 28 GDPR) is in place with our publishing sub-processor (Zernio); we are finalising written terms for the remaining sub-processors where not yet bound by their standard online DPA:',
                         sub: [
-                            { text: '**Zernio (ARBICHAT, S.L.)** — social media API aggregation: we pass OAuth tokens, post content, media files, and inbox data to Zernio solely to execute publishing and inbox operations on your behalf. Zernio is incorporated in Spain (EEA); however, data is processed on infrastructure with residency in North America (United States). This constitutes an international data transfer covered by Standard Contractual Clauses (Commission Decision 2021/914).' },
-                            { text: '**Stripe** — payment processing: billing address, email, and payment reference are shared with Stripe to process subscription payments. Stripe is located in the United States and operates under the EU–US Data Privacy Framework.' },
-                            { text: '**PostHog (PostHog, Inc.)** — product analytics, session replay, and error tracking: pseudonymised usage event data (feature interactions, page views, device/browser info), masked session recordings, and error reports are processed only after you have given explicit analytics consent via the cookie banner. Our PostHog instance is **PostHog Cloud EU, hosted in Frankfurt, Germany** — analytics data is stored and processed within the EEA. PostHog, Inc. is incorporated in the United States; any residual access from outside the EEA is governed by a Data Processing Agreement incorporating Standard Contractual Clauses (Commission Decision 2021/914).' },
+                            { text: '**Zernio** (contracting entity: ARBICHAT, S.L., trading as \u201cZernio\u201d, zernio.com), social media API aggregation and publishing: we pass OAuth tokens, post content, media files, and inbox data to Zernio solely to execute publishing and inbox operations on your behalf. The vendor is based in Girona, Spain (EEA); see Zernio\'s own privacy policy for details of the infrastructure it uses. We have a signed Data Processing Agreement with this vendor; to the extent Zernio processes data outside the EEA, such transfers are covered by Standard Contractual Clauses (Commission Decision 2021/914) under that agreement.' },
+                            { text: '**Stripe**, payment processing: billing address and payment details are collected and held directly by Stripe; we share your email and account identifiers with Stripe to set up and manage your subscription. For processing your subscription payments on our behalf, Stripe acts as our data processor; for fraud prevention, anti-money-laundering checks, and its own regulatory compliance, Stripe acts as an independent data controller under its own privacy policy. Stripe is located in the United States and operates under the EU-US Data Privacy Framework.' },
+                            { text: '**PostHog (PostHog, Inc.)**, product analytics, session replay, and error tracking: usage event data (feature interactions, page views, device/browser info), masked session recordings, and error reports are processed only after you have given explicit analytics consent via the cookie banner. Some data we send is identifying rather than pseudonymised in specific cases (for example, transactional email delivery tracking uses your email address directly so we can tell whether an email reached you); we are reviewing which flows can be pseudonymised further. Our PostHog instance is **PostHog Cloud EU, hosted in Frankfurt, Germany**, analytics data is stored and processed within the EEA. PostHog, Inc. is incorporated in the United States; any residual access from outside the EEA is governed by a Data Processing Agreement incorporating Standard Contractual Clauses (Commission Decision 2021/914).' },
+                            { text: '**Resend**, transactional and product email delivery: we use Resend to send account verification emails, onboarding and lifecycle emails, and to maintain the list of users eligible for those emails. Resend receives your email address, and where relevant your first name and the content of the email (which may include a verification or unsubscribe link). Under Resend\'s data processing terms, personal data held by Resend is deleted within 90 days after termination of our agreement with them. Resend is a company based in the United States; transfers are covered by Standard Contractual Clauses (Commission Decision 2021/914) or the EU-US Data Privacy Framework where applicable.' },
                             { text: '**Vercel Inc.** — backend API hosting and compute: server-side application code, API requests, and associated request logs are processed on Vercel\'s infrastructure. Vercel is located in the United States and transfers are covered by Standard Contractual Clauses (Commission Decision 2021/914).' },
-                            { text: '**Neon Inc.** — PostgreSQL database hosting: all structured platform data (accounts, campaigns, collaborations, social account metadata) is stored in a Neon-hosted PostgreSQL database. Neon is located in the United States and transfers are covered by Standard Contractual Clauses (Commission Decision 2021/914).' },
+                            { text: '**Neon, LLC (an affiliate of Databricks, Inc.)**, PostgreSQL database hosting: all structured platform data (accounts, connected-account metadata, post content and scheduling metadata) is stored in a Neon-hosted PostgreSQL database operated under the Databricks Master Cloud Services Agreement and the Databricks Privacy Notice. Neon, LLC and Databricks, Inc. are companies incorporated in the United States; whether the database contents leave the EEA depends on the hosting region of our database instance, which we are confirming. To the extent data is processed outside the EEA, transfers are covered by Standard Contractual Clauses (Commission Decision 2021/914).' },
                             { text: '**Google Firebase (Firebase Authentication)** — authentication token verification: authentication tokens issued to users may be verified against Firebase Authentication to validate active sessions. Firebase is a Google service located in the United States and operates under the EU–US Data Privacy Framework.' },
                             { text: 'A current list of sub-processors (including names, countries of processing, and applicable transfer safeguards) is available on request at kontakt@ad2.app.' },
                         ],
                     },
+                    { text: '**Third-party tools you authorize:** see Section 6a. These tools are recipients acting on your instruction, not our sub-processors.' },
                     { text: '**Legal authorities:** where required by law, court order, or to protect the rights and safety of ad2app or third parties.' },
                     { text: '**Business transfers:** in the event of a merger, acquisition, or sale of assets, personal data may be transferred under Art. 6(1)(f) — you will be notified before it becomes subject to a different privacy policy.' },
                 ],
             },
         ],
     },
+    {
+        id: 's6a',
+        title: '6a. Third-Party Integrations You Authorize (MCP)',
+        blocks: [
+            { kind: 'p', text: 'The Service includes an MCP (Model Context Protocol) server, operated by us as part of the Service, that lets you use ad2app from inside a third-party AI assistant or tool of your choice (for example an AI chat application or a code editor that supports MCP).' },
+            { kind: 'p', text: 'These tools are yours, not ours. When you connect one, it acts on your instruction, the same way your own browser does when you use the app directly. We do not select, engage, or control these tools, and they are not our sub-processors. What a tool does with data after retrieving it on your behalf is governed by that tool\'s own terms and privacy practices, which you should review before connecting it.' },
+            { kind: 'subheading', text: 'How authorization works' },
+            { kind: 'p', text: 'Before any access is granted, we show you a consent screen naming the tool and the access it requests. Nothing is shared until you approve. If you approve, our server issues that tool a grant that is enforced on our side: every request the tool makes is checked against what you approved, and the tool can act only within that grant. Depending on the access you approved, a connected tool can list your connected social accounts, create, view, update, cancel, or retry scheduled posts, read post and account analytics, and prepare media uploads, in each case on your behalf and within your own account only.' },
+            { kind: 'subheading', text: 'Revoking access' },
+            { kind: 'p', text: 'You can revoke a connected tool\'s access at any time by contacting us at {EMAIL}; we are adding a self-serve revocation control in your account settings. Revocation immediately invalidates the grant our server issued to that tool; it cannot make further requests. Revocation does not reach back into data the tool already retrieved while authorized; removing that is a matter for the tool itself.' },
+        ],
+    },
     {
         id: 's7',
         title: '7. International Data Transfers',
         blocks: [
-            { kind: 'p', text: 'Your data is primarily processed within the European Economic Area (EEA). Product analytics data (PostHog) is stored and processed on EU servers in Frankfurt, Germany. We use certain processors located outside the EEA, including processors based in the United States (currently: Vercel, Neon, Google Firebase, Stripe, and Zernio; plus residual support access by PostHog, Inc.). For all such transfers we ensure adequate safeguards through one or more of the following mechanisms:' },
+            { kind: 'p', text: 'Your data is primarily processed within the European Economic Area (EEA). Product analytics data (PostHog) is stored and processed on EU servers in Frankfurt, Germany. We use certain processors incorporated outside the EEA or using non-EEA infrastructure, including United States companies (currently: Vercel, Neon (Neon, LLC, an affiliate of Databricks, Inc.), Google Firebase, Stripe, and Resend, plus residual support access by PostHog, Inc.); for Zernio (an EEA company) and Neon, we are confirming the infrastructure and hosting regions involved. For all transfers outside the EEA we ensure adequate safeguards through one or more of the following mechanisms:' },
             {
                 kind: 'ul',
                 items: [
@@ -149,6 +159,8 @@ exports.PRIVACY_SECTIONS = [
                     { text: 'an adequacy decision by the European Commission covering the recipient country.' },
                 ],
             },
+            { kind: 'p', text: 'For Zernio specifically, our data processing agreement requires our prior written consent for any transfer outside the EEA and relies on Standard Contractual Clauses (Commission Decision 2021/914) where such a transfer occurs; Zernio\'s own internal security documentation references processing certain workloads in North America, which we are confirming operationally.' },
+            { kind: 'p', text: 'If you connect a third-party tool via MCP (Section 6a), any transfer of data to that tool happens at your instruction and under that tool\'s own terms; the safeguards above apply to our processors, not to tools you choose to connect.' },
             { kind: 'p', text: 'You may request copies of applicable SCCs or a summary of our Transfer Impact Assessment findings at kontakt@ad2.app.' },
         ],
     },
@@ -162,16 +174,16 @@ exports.PRIVACY_SECTIONS = [
                 items: [
                     { text: '**Right of access (Art. 15):** obtain a copy of the personal data we hold about you and information about how it is processed.' },
                     { text: '**Right to rectification (Art. 16):** request correction of inaccurate or incomplete personal data.' },
-                    { text: '**Right to erasure (Art. 17):** request deletion of your personal data where there is no overriding legal basis for continued processing. Following account deletion, your data is retained in a deactivated state for 30 days to allow account recovery. You may request immediate permanent deletion (waiving the recovery window) by explicitly stating this in your request.' },
+                    { text: '**Right to erasure (Art. 17):** request deletion of your personal data where there is no overriding legal basis for continued processing. When you delete your account, your data is held in a deactivated state for 30 days so an accidental deletion can be reversed, then permanently purged; your connected social accounts are disconnected and access revoked immediately, and that part is not reversible. You may request immediate permanent deletion, waiving the recovery window, by explicitly stating this in your request.' },
                     { text: '**Right to restriction (Art. 18):** request that we limit the processing of your data in certain circumstances.' },
                     { text: '**Right to data portability (Art. 20):** receive your data in a structured, machine-readable format and transmit it to another controller, where technically feasible.' },
-                    { text: '**Right to object (Art. 21):** object to processing based on legitimate interests or to profiling. We will cease unless we demonstrate compelling legitimate grounds. You may object to direct marketing at any time.' },
-                    { text: '**Right to withdraw consent (Art. 7(3)):** where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.' },
-                    { text: '**Rights related to automated decision-making and profiling (Art. 22):** our platform uses automated algorithms to match Influencers with relevant campaigns — this constitutes profiling within the meaning of Art. 4(4) GDPR. No final decision that produces legal or similarly significant effects is made solely by automated means; all campaign offers require affirmative acceptance by both parties. You may request human review of any automated match by contacting us. You may object to profiling under Art. 21(2).' },
+                    { text: '**Right to object (Art. 21):** object to processing based on legitimate interests. We will cease unless we demonstrate compelling legitimate grounds.' },
+                    { text: '**Right to withdraw consent (Art. 7(3)):** where processing is based on your consent (analytics cookies, marketing emails), you may withdraw it at any time without affecting the lawfulness of prior processing. Marketing-email consent can be withdrawn at any time via the unsubscribe link in any marketing email or by contacting us at {EMAIL}.' },
+                    { text: '**Automated decision-making (Art. 22):** we do not make any decision producing legal or similarly significant effects concerning you based solely on automated processing.' },
                     { text: '**Right to lodge a complaint (Art. 77):** you have the right to lodge a complaint with the Polish supervisory authority — Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, https://uodo.gov.pl — if you believe we are processing your personal data in violation of the GDPR.' },
                 ],
             },
-            { kind: 'note', label: 'Mandatory vs. optional data', text: 'Providing certain personal data (email address, name, account credentials) is a contractual requirement for accessing the Service — without it, we cannot create or maintain your account. Other fields (phone number, media kit files, audience metrics) are voluntary; their absence affects only platform functionality, not account access. Connecting social media accounts via OAuth is optional but required to access campaign matching, publishing, and inbox features.' },
+            { kind: 'note', label: 'Mandatory vs. optional data', text: 'Providing certain personal data (email address, name, account credentials) is a contractual requirement for accessing the Service, without it, we cannot create or maintain your account. Other fields (such as phone number) are voluntary. Connecting social media accounts via OAuth is optional but required to access publishing, analytics, and inbox features. Marketing-email consent is entirely optional and never a condition of using the Service.' },
         ],
     },
     {
@@ -184,7 +196,7 @@ exports.PRIVACY_SECTIONS = [
                 items: [
                     { text: '**Strictly necessary cookies:** required for authentication sessions and core platform functionality. Cannot be disabled without breaking the Service. Legal basis: Art. 6(1)(b) — contract performance; no consent required. Duration: session cookies expire when you close your browser; authentication cookies expire after 30 days of inactivity.' },
                     { text: '**Functional cookies:** set only in direct response to an action you take (e.g. selecting a language or theme preference), and strictly necessary to deliver that specific function you have requested. They do not track you across sessions beyond preserving your chosen setting. Legal basis: strictly necessary to fulfil your explicit request under Art. 173 of the Polish Telecommunications Act (ePrivacy); no separate consent required. Duration: up to 12 months, or cleared when you clear your browser data.' },
-                    { text: '**Analytics cookies (PostHog):** collect pseudonymised usage event data, enable session replay (with all typed input masked), and capture error reports to help us understand and improve how the Service is used. Legal basis: Art. 6(1)(a) — consent. **No analytics cookies are set and no analytics events are captured before you make a choice** in the cookie consent banner shown on first visit. If you accept, PostHog sets a first-party cookie (name beginning `ph_`) on the `ad2.app` domain, valid for up to 1 year, shared between our website and the app so you are not asked twice. If you decline, no analytics cookie is set and no events are collected. Analytics data is processed on PostHog Cloud EU servers in Frankfurt, Germany (see Section 6).' },
+                    { text: '**Analytics cookies (PostHog):** collect usage event data in pseudonymised form (other than the identifying flows described in Section 6), enable session replay (with form-field values masked; see Section 3), and capture error reports to help us understand and improve how the Service is used. Legal basis: Art. 6(1)(a) — consent. **No analytics cookies are set and no analytics events are captured before you make a choice** in the cookie consent banner shown on first visit. If you accept, PostHog sets a first-party cookie (name beginning `ph_`) on the `ad2.app` domain, valid for up to 1 year, shared between our website and the app so you are not asked twice. If you decline, no analytics cookie is set and no events are collected. Analytics data is processed on PostHog Cloud EU servers in Frankfurt, Germany (see Section 6).' },
                 ],
             },
             { kind: 'p', text: 'You may withdraw or update your cookie consent at any time via the "Cookie settings" link in the footer of our website, or on this Privacy Policy page in the app. Withdrawing analytics consent does not affect platform functionality.' },
@@ -200,8 +212,10 @@ exports.PRIVACY_SECTIONS = [
             {
                 kind: 'ul',
                 items: [
-                    { text: 'Encryption in transit (TLS 1.2+) and at rest for stored personal data.' },
-                    { text: 'Hashed storage of passwords using bcrypt with appropriate cost factors; OAuth tokens encrypted at rest.' },
+                    { text: 'Encryption in transit (TLS 1.2+).' },
+                    { text: 'Hashed storage of passwords using bcrypt with appropriate cost factors.' },
+                    { text: 'We are completing a review to ensure any OAuth tokens we hold directly are encrypted at rest; tokens held by our publishing processor Zernio are subject to Zernio\'s own security measures.' },
+                    { text: 'Server-enforced access grants for third-party tools you authorize via MCP (Section 6a): every request is checked against the access you approved, and grants are individually revocable.' },
                     { text: 'Role-based access controls with least-privilege principles; access logs retained for audit purposes.' },
                     { text: 'Pseudonymisation of analytics and usage data where technically feasible.' },
                     { text: 'Regular vulnerability assessments and periodic penetration testing.' },
@@ -216,8 +230,8 @@ exports.PRIVACY_SECTIONS = [
         title: '11. Third-Party Links, Social Platforms, and Inbox Data',
         blocks: [
             { kind: 'p', text: 'The Service allows you to connect the social media accounts you choose to enable platform features. Supported platforms currently include Instagram, TikTok, X (Twitter), YouTube, LinkedIn, Facebook, Threads, Pinterest, Reddit, and Bluesky. When you authorise an OAuth connection, ad2app receives data from that platform\'s API as permitted by your OAuth consent screen. The source of all such data is the respective social media platform\'s API.' },
-            { kind: 'p', text: '**Inbox data and third-party communications:** when you use the inbox features, direct message conversations and post comments from your connected social media accounts are fetched and stored. This includes messages and comments sent by your followers and other third parties on those platforms. Those individuals have not directly provided their data to ad2app. We process this data under Art. 6(1)(b) (to provide the inbox feature you have contracted for) and rely on the exemption in Art. 14(5)(b) GDPR — providing individual notice to each such person would require disproportionate effort given the volume and platform-derived nature of the data. Inbox data is not used for profiling, advertising, or any purpose beyond displaying your social media communications within the platform.' },
-            { kind: 'p', text: '**Audience data (Art. 14 GDPR):** when you connect a social media account, the connected platform may provide aggregate audience data (e.g. demographic statistics about your followers). This data originates from the social platform and relates to individuals who are not in a direct relationship with ad2app. We rely on Art. 14(5)(b) GDPR — individual notification is impossible given the aggregate and platform-derived nature of this data. It is processed solely in aggregated form for influencer–brand matching and campaign analytics, and is not used for any other purpose.' },
+            { kind: 'p', text: '**Inbox data and third-party communications:** when you use the inbox features, direct message conversations and post comments from your connected social media accounts are fetched and stored. This includes messages and comments sent by your followers and other third parties on those platforms. Some of this data (for example public post comments) originates from publicly accessible sources on the connected platform; direct messages do not. Those individuals have not directly provided their data to ad2app. We process this data under Art. 6(1)(b) (to provide the inbox feature you have contracted for) and rely on the exemption in Art. 14(5)(b) GDPR — providing individual notice to each such person would require disproportionate effort given the volume and platform-derived nature of the data. In line with Art. 14(5)(b), and having regard to the number of individuals concerned, the age of the data, and the safeguards applied, we take appropriate measures to protect these individuals\' rights, freedoms, and legitimate interests, including by making this information publicly available in this policy and by handling any rights request from such a person received at {EMAIL}; our balancing assessment is documented in our Record of Processing Activities (Art. 30 GDPR). Inbox data is not used for profiling, advertising, or any purpose beyond displaying your social media communications within the platform.' },
+            { kind: 'p', text: '**Audience data (Art. 14 GDPR):** when you connect a social media account, the connected platform may provide aggregate audience data (e.g. demographic statistics about your followers). This data originates from the social platform and relates to individuals who are not in a direct relationship with ad2app. It is processed solely as anonymous, aggregate statistics and does not identify any individual; it is therefore not personal data within the meaning of the GDPR (Recital 26) and Art. 14 does not apply to it. Insofar as any element of this data were nevertheless treated as personal data, we would rely on the exemption in Art. 14(5)(b) GDPR (disproportionate effort) and discharge our obligation by making this information publicly available in this policy. Audience data is not used for any other purpose.' },
             { kind: 'p', text: 'We are not responsible for the privacy practices of third-party social platforms. Please review their privacy policies before connecting your accounts.' },
         ],
     },

package/dist/legal/terms.js

@@ -14,29 +14,17 @@ exports.TERMS_SECTIONS = [
         id: 's2',
         title: '2. Service Description',
         blocks: [
-            { kind: 'p', text: 'ad2app is a social media management platform for content creators. At its core, the Service lets you connect your own social media accounts, compose a post once, schedule and publish it to the platforms you choose, and track the performance of your published posts. The Service includes:' },
-            {
-                kind: 'ul',
-                items: [
-                    { text: 'Connecting your own social media accounts via authorised access (OAuth) — currently Instagram, TikTok, X (Twitter), YouTube, LinkedIn, Facebook, Threads, Pinterest, Reddit, and Bluesky.' },
+            { kind: 'p', text: 'ad2app is a social media scheduling platform for content creators. The Service lets you connect your own social media accounts, compose a post once, schedule and publish it to the platforms you choose, and track the performance of your published posts. The Service includes:' },
+            { kind: 'ul', items: [
+                    { text: 'Connecting your own social media accounts via authorised access (OAuth), currently Instagram, TikTok, X (Twitter), YouTube, LinkedIn, Facebook, Threads, Pinterest, Reddit, and Bluesky.' },
                     { text: 'Composing a post once and scheduling and publishing it to the connected platforms you select.' },
                     { text: 'Analytics and reporting on your published posts.' },
+                    { text: 'A unified inbox for comments and direct messages from your connected platforms.' },
                     { text: 'Media and content file management.' },
-                ],
-            },
-            { kind: 'p', text: 'ad2app also operates as a broader B2B influencer marketing platform. Depending on your account type and the features made available to you, the Service may additionally enable brands and agencies ("Advertisers") to discover, manage, and collaborate with content creators and influencers ("Influencers") on marketing campaigns, including:' },
-            {
-                kind: 'ul',
-                items: [
-                    { text: 'Campaign creation, management, and tracking tools.' },
-                    { text: 'Influencer discovery and profile management.' },
-                    { text: 'Collaboration and offer management workflows.' },
-                    { text: 'Messaging between Advertisers and Influencers.' },
-                    { text: 'Social media inbox management (DMs and comments from connected platforms).' },
-                ],
-            },
-            { kind: 'p', text: 'Not all features described in these Terms are available to every User or in every plan. Where a clause applies only to a particular feature or account type (for example, campaigns or collaborations between Users), it applies to you only to the extent you use that feature.' },
-            { kind: 'p', text: 'We reserve the right to modify, suspend, or discontinue any part of the Service at any time, with reasonable prior notice where technically or commercially practicable.' },
+                    { text: 'Optional connection of third-party AI assistants and tools that support the Model Context Protocol (MCP), letting you manage scheduling, posting, and analytics from within a tool of your choice. See Section 13 and our {PRIVACY}.' },
+                ] },
+            { kind: 'p', text: 'The Service is offered on three plans: **Free** (connecting new social accounts and publishing are not available on this plan; if you previously had a paid plan, your previously-connected accounts, post history, and analytics also become inaccessible while you are on the Free plan \u2014 that data is retained, not deleted, and becomes available again if you resubscribe), **Starter**, and **Pro** (Starter and Pro differ only in how many social accounts you may connect; all other features are identical). Current plan details and pricing are shown in the app and on our pricing page.' },
+            { kind: 'p', text: 'Not all features described in these Terms are available in every plan. We may modify the Service where necessary for a valid reason — including to comply with law, maintain security, reflect changes in the third-party platforms we integrate with, or improve the Service. Where a modification would negatively and more than minorly affect your access to or use of a paid plan, we will notify you on a durable medium (such as email) at least 30 days in advance and, if you are a consumer, you may terminate your subscription free of charge within 30 days of the notice and receive a pro-rata refund of prepaid Fees for the unused period.' },
         ],
     },
     {
@@ -67,20 +55,21 @@ exports.TERMS_SECTIONS = [
                     { text: 'Upload, transmit, or distribute content that is unlawful, harmful, defamatory, obscene, or that infringes third-party intellectual property rights.' },
                     { text: 'Impersonate any person or entity or misrepresent your affiliation with any person or entity.' },
                     { text: 'Attempt to gain unauthorised access to any part of the Service or its related systems.' },
-                    { text: 'Use automated means (bots, scrapers, crawlers) to access or collect data from the Service without our express prior written consent.' },
-                    { text: 'Send unsolicited communications (spam) to other platform users.' },
+                    { text: 'Use automated means (bots, scrapers, crawlers) to access or collect data from the Service without our express prior written consent; this does not restrict your use of a third-party tool you have authorized via MCP within the access you approved (see Section 13).' },
+                    { text: 'Send unsolicited communications (spam) through the Service.' },
                     { text: 'Engage in any activity that disrupts or interferes with the integrity or performance of the Service.' },
                     { text: 'Circumvent or disable any security or access control features of the Service.' },
+                    { text: 'Use a connected third-party tool (see Section 13) to perform any action on the Service that would itself violate these Terms if you had done it directly.' },
                 ],
             },
-            { kind: 'p', text: 'We reserve the right to suspend or terminate accounts that violate this section without prior notice.' },
+            { kind: 'p', text: 'We reserve the right to suspend or terminate accounts that violate this section. We enforce these restrictions diligently, objectively, and proportionately, with due regard to your rights and legitimate interests, including your freedom of expression (Art. 14(4) DSA); where we do so, the statement-of-reasons and redress commitments in Section 5 (Content moderation) apply.' },
         ],
     },
     {
         id: 's5',
         title: '5. User Content',
         blocks: [
-            { kind: 'p', text: '"User Content" means any data, text, images, video, or other material you upload, post, or otherwise transmit through the Service.' },
+            { kind: 'p', text: '"User Content" means any data, text, images, video, or other material you upload, post, or otherwise transmit through the Service, including content you submit through a connected third-party tool.' },
             {
                 kind: 'ul',
                 items: [
@@ -89,12 +78,18 @@ exports.TERMS_SECTIONS = [
                     { text: 'We may remove User Content that violates these Terms or applicable law.' },
                 ],
             },
+            { kind: 'subheading', text: 'Content moderation (Art. 14 DSA)' },
+            { kind: 'p', text: 'We may restrict, remove, or disable access to User Content, or suspend or terminate an account, where the content is illegal or breaches these Terms. Moderation decisions are made by human review; we do not use automated tools or algorithmic decision-making to detect or remove content. If you believe a moderation decision was wrong, you may contest it by writing to kontakt@ad2.app; we will review your objection and reply with a reasoned decision.' },
+            { kind: 'subheading', text: 'Statement of reasons (Art. 17 DSA)' },
+            { kind: 'p', text: 'Where we remove or disable access to your content, suspend or terminate your account, or restrict payments on the ground that content is illegal or breaches these Terms, we will provide you with a clear and specific statement of reasons — what we did and its scope, the facts and circumstances relied on, whether automated means were used in taking the decision, the legal or contractual ground, and clear and user-friendly information on how you can contest the decision — except for restrictions taken pursuant to a legal order under Art. 9 DSA (which follow that Article\u2019s own notice rules) or where the content is deceptive high-volume commercial content (spam).' },
             { kind: 'subheading', text: 'Platform non-liability for User Content' },
             { kind: 'p', text: '**ad2app does not create, edit, endorse, or control User Content.** We act solely as a hosting intermediary within the meaning of Article 6 of the EU Digital Services Act (Regulation (EU) 2022/2065) and are not liable for User Content unless we have actual knowledge of its illegal nature and fail to act expeditiously to remove or disable access to it.' },
-            { kind: 'p', text: 'You are **solely and exclusively responsible** for any content you create, publish, share, schedule, or distribute through the Service, including — but not limited to — scheduled posts, captions, images, videos, hashtags, campaign materials, promotional posts, sponsored content, and any other material posted on third-party platforms (including the social media platforms you connect, such as Instagram, TikTok, X (Twitter), YouTube, LinkedIn, Facebook, Threads, Pinterest, Reddit, and Bluesky) using ad2app as a tool or workflow. ad2app assumes no liability for such content regardless of whether it was composed, scheduled, planned, briefed, or tracked through the platform.' },
+            { kind: 'p', text: 'You are **solely and exclusively responsible** for any content you create, publish, share, schedule, or distribute through the Service, including but not limited to scheduled posts, captions, images, videos, hashtags, and any other material posted on third-party platforms (including the social media platforms you connect, such as Instagram, TikTok, X (Twitter), YouTube, LinkedIn, Facebook, Threads, Pinterest, Reddit, and Bluesky) using ad2app as a tool or workflow, whether that content was composed directly by you, drafted with the help of a connected AI assistant, or scheduled, planned, or tracked through the platform. ad2app assumes no liability for such content.' },
             { kind: 'p', text: 'In particular, you are responsible for ensuring that all published content complies with: (a) applicable advertising and marketing laws; (b) platform-specific community guidelines and terms of service of any third-party social media platform; (c) intellectual property rights of third parties; and (d) all applicable laws of the jurisdiction(s) where the content is distributed or viewed.' },
             { kind: 'subheading', text: 'Digital Services Act — Points of Contact (Art. 11 DSA)' },
             { kind: 'p', text: 'In accordance with Art. 11 of Regulation (EU) 2022/2065 (Digital Services Act), ad2app designates the following single point of contact for direct communication with Member State authorities, the European Commission, and the European Board for Digital Services: kontakt@ad2.app. Communications may be conducted in Polish or English.' },
+            { kind: 'subheading', text: 'Point of contact for users (Art. 12 DSA)' },
+            { kind: 'p', text: 'You can contact us directly and rapidly at kontakt@ad2.app. This channel is handled by our team and does not rely solely on automated tools.' },
             { kind: 'subheading', text: 'Notice-and-action procedure (Art. 16 DSA)' },
             { kind: 'p', text: 'Any person or entity may submit a notice of alleged illegal content hosted on the ad2app platform to kontakt@ad2.app. To be effective under Art. 16(2) DSA, a notice should include:' },
             {
@@ -102,7 +97,7 @@ exports.TERMS_SECTIONS = [
                 items: [
                     { text: 'an explanation of why the content is considered illegal under EU or applicable national law;' },
                     { text: 'the precise location (URL or sufficient description) of the content;' },
-                    { text: 'the name and contact details of the notifier, unless the notice concerns content constituting a criminal offence involving the notifier; and' },
+                    { text: 'the name and email address of the notifier, except where the notice concerns information considered to involve one of the offences referred to in Articles 3 to 7 of Directive 2011/93/EU; and' },
                     { text: 'a statement that the notifier believes in good faith that the information and allegations are accurate and complete.' },
                 ],
             },
@@ -126,37 +121,28 @@ exports.TERMS_SECTIONS = [
     },
     {
         id: 's7',
-        title: '7. Campaigns and Collaborations Between Users',
+        title: '7. Sponsored Content and Advertising Disclosure',
         blocks: [
-            { kind: 'p', text: 'This section applies where the Service is used to facilitate campaigns or collaborations between Users; it does not apply to your use of the scheduling, publishing, and analytics features for your own accounts. Where the Service facilitates agreements between Advertisers and Influencers, ad2app is not a party to any agreement reached between Users through the platform and has no control over the performance, quality, legality, or accuracy of campaigns or content produced. **In all cases, ad2app is not responsible for any content that Users publish, broadcast, schedule, or distribute on any platform — including third-party social media platforms — whether or not that content was composed, scheduled, planned, briefed, approved, or tracked through the Service.**' },
-            { kind: 'p', text: 'Each User is solely responsible for:' },
-            {
-                kind: 'ul',
-                items: [
-                    { text: 'ensuring that all published campaign content complies with applicable advertising laws and disclosure obligations, including the Polish Act on Combating Unfair Commercial Practices (including the obligation to clearly mark sponsored posts as "reklama" or "#ad"), the EU Digital Services Act, and any platform-specific rules of the social media platform on which the content is distributed;' },
-                    { text: 'obtaining all necessary licences, consents, and permissions for any creative materials (music, images, trademarks, likeness) used in published content;' },
-                    { text: 'fulfilling the obligations agreed upon with the counterparty;' },
-                    { text: 'any tax obligations arising from payments made or received through the platform.' },
-                ],
-            },
-            { kind: 'p', text: 'ad2app shall have no liability arising from claims by third parties — including other Users, consumers, regulators, or rights-holders — that relate to the content, accuracy, legality, or effects of any material posted by Users in connection with a campaign, regardless of whether ad2app was involved in the planning or delivery of that campaign.' },
-            { kind: 'p', text: '**DSA disclosure tools:** ad2app provides campaign management tools that include disclosure labelling features to assist Advertisers and Influencers in meeting their obligations under Regulation (EU) 2022/2065 and applicable national advertising law. ad2app is not an advertising intermediary within the meaning of DSA Art. 26 with respect to content published on third-party social media platforms; however, we cooperate with users to ensure our platform tools support compliant disclosure practices.' },
+            { kind: 'p', text: 'If you use the Service to publish sponsored content, advertisements, or paid partnerships on your own accounts, you are solely responsible for complying with applicable advertising laws and disclosure obligations, including the Polish Act on Combating Unfair Commercial Practices (including the obligation to clearly mark sponsored posts, for example as "reklama" or "#ad"), the EU Digital Services Act, and the platform-specific rules of the social media platform on which the content is distributed (for example paid-partnership or branded-content toggles).' },
+            { kind: 'p', text: 'Where the Service offers disclosure labelling features (such as a paid-partnership setting for a supported platform), these are provided to assist you; using them does not by itself guarantee compliance, and not every platform or legal requirement is covered by a product feature. You remain responsible for obtaining all necessary licences, consents, and permissions for any creative materials (music, images, trademarks, likeness) used in your published content.' },
         ],
     },
     {
         id: 's8',
         title: '8. Fees and Payment',
         blocks: [
-            { kind: 'p', text: 'Certain features of the Service may require payment of fees as set out in the applicable subscription plan or order form ("Fees"). Fees are stated in EUR or PLN and are exclusive of VAT unless otherwise indicated.' },
+            { kind: 'p', text: 'Certain features of the Service require payment of fees as set out in the applicable subscription plan (Starter or Pro; see Section 2) ("Fees"). Fees are stated in EUR or PLN. If you are a consumer, all Fees are shown inclusive of applicable VAT, as the total amount payable per billing period, before you confirm your order; for business customers, Fees are stated exclusive of VAT unless otherwise indicated. Payment is processed by Stripe; we do not receive or store your card details (see our {PRIVACY}).' },
             {
                 kind: 'ul',
                 items: [
+                    { text: 'Paid plans renew automatically at the end of each billing period at the then-current Fee until cancelled. You may cancel renewal at any time in your account settings; cancellation takes effect at the end of the current paid period, you retain access until then, and no further Fees are charged after that.' },
                     { text: 'Fees are non-refundable except where expressly stated or required by applicable law.' },
-                    { text: 'We reserve the right to change Fees with at least 30 days\' notice before the change takes effect.' },
+                    { text: 'We reserve the right to change Fees with at least 30 days\' notice before the change takes effect; a changed Fee applies only from your next billing period after the notice. If you are a consumer and do not accept a Fee increase, you may cancel your subscription before the increase takes effect, free of charge.' },
                     { text: 'Failure to pay Fees may result in suspension of your access to paid features.' },
                 ],
             },
-            { kind: 'p', text: '**Consumer right of withdrawal:** if you are acting as a natural person outside your professional or business capacity (consumer), you have a right of withdrawal from a service contract within 14 days under the Polish Consumer Rights Act (Ustawa o prawach konsumenta) and EU Consumer Rights Directive 2011/83/EU. By expressly requesting immediate access to the Service at the point of purchase and acknowledging this notice, you agree that the right of withdrawal is lost upon full performance of a digital service, in accordance with Art. 38(1)(a) of the Directive.' },
+            { kind: 'p', text: '**Consumer right of withdrawal:** if you are acting as a natural person outside your professional or business capacity (consumer), you have a right of withdrawal from a service contract within 14 days under the Polish Consumer Rights Act (Ustawa o prawach konsumenta) and EU Consumer Rights Directive 2011/83/EU. By expressly requesting immediate access to the Service at the point of purchase and acknowledging this notice, you agree that the right of withdrawal is lost upon full performance of the service, in accordance with Article 16(a) of Directive 2011/83/EU (as implemented by art. 38 of the Polish Ustawa o prawach konsumenta).' },
+            { kind: 'p', text: 'If you asked us to begin providing the Service during the 14-day withdrawal period and then withdraw before the end of the subscription term, you must pay an amount proportionate to the part of the Service already provided up to the moment you inform us of your withdrawal, calculated against the total contract price; we will refund the balance within 14 days using the same means of payment you used, unless you expressly agree otherwise.' },
             { kind: 'p', text: 'If you wish to exercise the right of withdrawal before performance is complete, you may use the standard form below or any unambiguous statement:' },
             {
                 kind: 'box',
@@ -179,7 +165,8 @@ exports.TERMS_SECTIONS = [
         title: '9. Disclaimer of Warranties',
         blocks: [
             { kind: 'p', text: 'The Service is provided "as is" and "as available" without any warranty of any kind, express or implied, including but not limited to warranties of merchantability, fitness for a particular purpose, or non-infringement, to the fullest extent permitted by applicable law.' },
-            { kind: 'p', text: 'We do not warrant that the Service will be uninterrupted, error-free, or free of viruses or other harmful components.' },
+            { kind: 'p', text: 'We do not warrant that the Service will be uninterrupted, error-free, or free of viruses or other harmful components. We do not warrant the availability, accuracy, or behavior of any third-party tool you choose to authorize via MCP (see Section 13); your use of such a tool is at your own risk and subject to that tool\'s own terms.' },
+            { kind: 'p', text: '**If you are a consumer, nothing in this Section limits your statutory rights.** We are legally required to supply a service that conforms with the contract throughout the subscription period. Where the Service does not conform, you are entitled to have it brought into conformity and, failing that, to a proportionate reduction in price or to terminate the contract, under Directive (EU) 2019/770 as implemented in the Polish Ustawa o prawach konsumenta. The "as is" disclaimer above applies only to the extent permitted by applicable law and does not apply to consumers.' },
         ],
     },
     {
@@ -205,8 +192,9 @@ exports.TERMS_SECTIONS = [
             {
                 kind: 'ul',
                 items: [
-                    { text: 'You may close your account at any time by contacting us at kontakt@ad2.app.' },
-                    { text: 'We may suspend or terminate your account immediately if you materially breach these Terms, or with 30 days\' notice for any other reason.' },
+                    { text: 'You may close your account at any time from your account settings or by contacting us at {EMAIL}. When you close your account, your connected social accounts are disconnected and their access revoked immediately and irreversibly; your account data is held in a deactivated state for 30 days, during which you can restore the account (you will need to reconnect your social platforms), after which it is permanently deleted. See our {PRIVACY}.' },
+                    { text: 'We may suspend or terminate your account immediately if you materially breach these Terms, or with 30 days\' notice for any other reason. Where we suspend or terminate on the ground of illegal content or a breach of these Terms, we will provide a statement of reasons and redress information as described in Section 5.' },
+                    { text: 'On withdrawal or termination, you may request — free of charge, without hindrance, and within a reasonable time — an export of the content you provided or created through the Service (such as your drafts and uploaded media), other than personal data governed by our {PRIVACY}, in a commonly used, machine-readable format. Send the request to {EMAIL}.' },
                     { text: 'Upon termination, your licence to use the Service ceases. Sections 5, 6, 10, 11, 13, 14, and 15 survive termination.' },
                 ],
             },
@@ -214,11 +202,11 @@ exports.TERMS_SECTIONS = [
     },
     {
         id: 's13',
-        title: '13. Data Protection',
+        title: '13. Data Protection and Third-Party Tools',
         blocks: [
             { kind: 'p', text: 'Our collection and use of personal data is governed by our {PRIVACY}, which forms part of these Terms. By accepting these Terms, you acknowledge that you have read and understood our Privacy Policy.' },
-            { kind: 'p', text: 'The Service uses third-party data processors — including EU-hosted product analytics (PostHog Cloud EU), payment processing (Stripe), and social media API aggregation (Zernio) — as listed and described in the Privacy Policy. Usage analytics and session replay operate only with your consent, which you may give or withdraw at any time via the cookie consent controls described in the Privacy Policy.' },
-            { kind: 'p', text: 'Where you, as an Advertiser, use the Service to access, communicate with, or manage Influencer personal data through the platform, ad2app acts as a **data processor** on your behalf under Article 28 GDPR, and you act as the **data controller** for that processing. Our Data Processing Agreement (available on request at kontakt@ad2.app) governs that relationship. You remain solely responsible for ensuring you have a valid legal basis for any personal data processing you direct through the platform and for your own compliance with GDPR in your capacity as controller.' },
+            { kind: 'p', text: 'The Service uses third-party data processors, including EU-hosted product analytics (PostHog Cloud EU), payment processing (Stripe), transactional email (Resend), and social media API aggregation (Zernio), as listed and described in the {PRIVACY}. Usage analytics and session replay operate only with your consent, which you may give or withdraw at any time via the cookie consent controls described in the Privacy Policy. Marketing emails are sent only with your opt-in consent, withdrawable at any time via the unsubscribe link in any such email or by contacting us at {EMAIL}.' },
+            { kind: 'p', text: '**Third-party tools you authorize (MCP):** if you connect a third-party AI assistant or tool to the Service via MCP, that tool acts on your instruction as your own connected tool; it is not our sub-processor and we do not control it. Access is granted only after you approve a consent screen describing what the tool may do, is enforced by our server against exactly what you approved, and can be revoked by you at any time (see the Privacy Policy, Section 6a, for how to revoke). What the tool does with data it retrieves on your behalf is governed by that tool\'s own terms. See our {PRIVACY} for the full description.' },
         ],
     },
     {

package/dist/publish-limits/index.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Canonical publish-limits source of truth for ad2app (AD2-1140 Wave 1).
+ *
+ * Single source of truth for (a) the per-platform compose/publish limits
+ * (character count, image/video counts, max video duration) and (b) the
+ * universal media-upload byte cap ad2app itself enforces.
+ *
+ * Provenance:
+ *  - Per-platform values are the CORRECTED figures from
+ *    ad2app-frontend/src/components/social/compose/platformConstants.ts
+ *    (PLATFORM_CONFIGS[*].charLimit / maxImages / maxVideos / acceptsVideo /
+ *    acceptsImages / metadata.mediaConstraints.maxVideoDuration).
+ *  - MAX_UPLOAD_BYTES matches ad2app-backend
+ *    src/modules/late/late-media-upload.service.ts MAX_FILE_SIZE_BYTES + FR-105.
+ *
+ * Wave 2 (separate PRs) makes ad2app-frontend and ad2app-backend import from
+ * here instead of carrying their own copies, and deletes the stale
+ * per-platform maxImageSize/maxVideoSize byte values that this table
+ * deliberately does NOT carry forward (they were never the real enforced
+ * cap — MAX_UPLOAD_BYTES is).
+ */
+import type { PlatformPublishLimits, PublishPlatform } from './types';
+export type { PlatformPublishLimits, PublishPlatform } from './types';
+/**
+ * The universal media-upload byte cap ad2app enforces on every publish,
+ * regardless of destination platform. This is ad2app's own operational
+ * choice (all media flows through the /late/uploadMedia path), NOT a
+ * per-platform maximum — do not read this as "what X/Instagram/etc. allow."
+ */
+export declare const MAX_UPLOAD_BYTES: number;
+/** Per-platform compose/publish limits for all 10 connectable platforms. */
+export declare const PUBLISH_LIMITS: Record<PublishPlatform, PlatformPublishLimits>;
+/** All publish platforms, canonical order (mirrors PUBLISH_LIMITS key order). */
+export declare const ALL_PUBLISH_PLATFORMS: PublishPlatform[];