Privacy policy

Last updated 20 October 2026

bonilio plans, schedules and publishes social media posts for you, and shows how they perform. This page explains what we collect, why, and the choices you have.

What we collect

• Account details: your name, email address and a hashed password.
• Brand details you give us: website, tone, colours, fonts, images and the posts you create or approve.
• Connected accounts: when you connect a social account (for example Instagram, Facebook, LinkedIn, Pinterest, TikTok, YouTube, X, Threads, Bluesky or Mastodon) we receive an access token, the account name and profile picture, and, with your permission, the posts, comments, messages and performance numbers we need to run the features you use. Tokens are stored encrypted.
• Billing: handled by Stripe. We never see or store your card number.
• Usage data: basic logs (for example errors and request times) to keep the service running.

How we use it

• To publish the posts you schedule or approve, and to show analytics, comments and messages in one place.
• To generate captions and images for you. Your brand details and prompts are sent to AI providers for this. We use their business API access, which by default is not used to train their models.
• To send you emails you asked for, such as sign-in links, approval requests and alerts. You can turn these off in Settings or with the unsubscribe link in each email.

What we never do

• We do not sell your data.
• We do not post, message or comment from your accounts unless you set up a post or automation that does so.
• We use data from social platforms only to provide bonilio to you, and we follow each platform's developer rules.

Who we share it with

Only the services that help us run bonilio: our hosting and database provider, Stripe (payments), our email sender, AI model providers (to generate content), and the social networks you choose to connect (to publish and read on your behalf). We may also disclose information if the law requires it.

How long we keep it

We keep your data while your account is open. Deleted posts stay in the trash for 30 days. When you disconnect a social account we delete its access token straight away, and when you delete your account we delete your workspace and its data. See how to delete your data.

Your choices

You can disconnect any social account, export or delete your content, change email preferences, or delete your account from Settings. To ask for a copy of your data or for anything we cannot do from Settings, email support@bonilio.com.

Children

bonilio is not for anyone under 16.

Changes and contact

If we change this policy in a way that matters we will tell you by email or in the app. Questions: support@bonilio.com.