Privacy Policy

Redditoro (“we”) provides a Reddit marketing and AI-visibility tool at redditoro.com and is operated from Poland (EU). For the personal data described below, we act as the data controller. For payments, our merchant of record, Creem (creem.io), acts as an independent controller of your payment data (see “Payments”). For any question about your data, email [email protected].

We collect only what we need to run the service:

• Account: your email address (via magic-link or Google sign-in). If you use Google, we receive your verified email and name.
• Monitoring configuration: the products, keywords, subreddits, competitors, and questions you set up.
• Matched content: public Reddit posts we surface for you, the replies AI drafts, and the relevance/lead scores it produces.
• AI-visibility results: whether AI assistants mention your brand for the questions you track, over time.
• Usage: scan history and AI token counts, used for limits, analytics, and billing.
• Connected accounts: if you connect a Reddit account, we store an access token so you can publish from it; you can disconnect anytime.
• Optional API keys: if you add your own AI or Reddit keys, they are encrypted at rest.
• Technical: limited request metadata (such as IP address) used to prevent abuse and rate-limit sign-ins.

To provide and operate the service — monitor sources, draft and score replies, measure AI visibility, send you magic-link sign-ins and lead alerts, process billing, prevent abuse, and improve the product. We do not sell your data or use it for advertising, and we do not use your private content to train our own models.

Where the GDPR applies, we process your data to perform our contract with you (providing the service and billing), for our legitimate interests (securing and improving the service, preventing abuse), to comply with legal obligations (such as tax records), and with your consent where required (such as optional integrations).

Our plans (Starter, Growth, and Agency) are sold and processed by Creem (creem.io) as our merchant of record. As the seller of record, Creem collects and processes your payment details, calculates and remits applicable taxes (including EU VAT), issues invoices and receipts, and handles payment-related requests. We never receive or store full card details. We receive only limited billing status (such as your plan and whether a subscription is active) to unlock features. Creem's own privacy policy governs the payment data it holds.

We share data with providers strictly to run the product:

• Supabase — database and hosting for your data.
• OpenAI and Anthropic — AI models that draft replies, score relevance, and analyze AI-search visibility from post and thread text.
• Reddit API — reading the public posts you asked us to monitor, and publishing from your connected account when you choose to.
• Creem (creem.io) — subscription and one-time billing, invoicing, and tax as our merchant of record.
• Resend — sending magic-link and alert emails.
• Google — optional OAuth sign-in.
• DataFast — privacy-friendly product analytics (aggregate usage and conversions), without advertising or cross-site tracking cookies.

To surface leads we read public Reddit posts and comments through Reddit's official API. This content can include personal data of the people who posted it. We process it only to provide the monitoring you configured, based on our and your legitimate interest in finding relevant public discussions. We do not use it to build advertising profiles or to train our own models.

Some of these providers are located in the United States or other countries, so your data may be processed outside your own. Where required, such transfers rely on appropriate safeguards (such as the EU Standard Contractual Clauses) offered by those providers.

We use an essential cookie to keep you signed in. For product analytics we use DataFast, a privacy-friendly service that measures aggregate usage and conversions without advertising or cross-site tracking cookies. We do not run ad networks, and we do not sell analytics data.

We keep your data while your account is active. You can request deletion at any time; we'll remove your account and associated data, except where we must retain records (e.g., billing and tax) to meet legal obligations.

Each account's data is isolated at the database level with row-level security, any API keys and connected-account tokens you add are encrypted at rest, and traffic is served over TLS. No system is perfectly secure, but we take reasonable measures to protect your information.

You can access, export, correct, or delete your data. Depending on your location you may have additional rights under laws such as GDPR or CCPA, including the right to object to or restrict certain processing and to lodge a complaint with your local data-protection supervisory authority (in Poland, the President of the Personal Data Protection Office, UODO). To exercise any of these, email [email protected].

Redditoro is not intended for anyone under 16, and we don't knowingly collect their data.

We may update this policy; we'll revise the date above and, for material changes, notify you. Continued use means you accept the update.

Questions? Email [email protected].