Privacy Policy.

Orange Potato, operated by Hehl Holdings LLC, collects: (a) account data such as name, email address, organization, and password hash; (b) billing and subscription records handled through Stripe; (c) content and workspace data such as brand profile inputs, generated drafts, approvals, and publishing history; (d) connected account data needed to support social publishing features; and (e) usage data such as IP address, browser or device type, and product interaction events.

When you authenticate with Google, we may receive your Google account profile information, such as your name, email address, and profile image, to create or sign you into your Orange Potato account. When you connect YouTube, we may receive OAuth access tokens, refresh tokens, granted scope information, and channel identifiers or channel titles necessary to verify the connected account and support YouTube publishing features. We do not receive or store your Google Account password.

We process personal data to: (i) provide and maintain the Service; (ii) authenticate users and secure accounts; (iii) process payments and manage subscriptions; (iv) operate connected-channel features requested by the user; (v) improve product functionality; (vi) send transactional and, where permitted, marketing communications; and (vii) comply with legal obligations. We do not sell personal data or Google user data.

Google user data is used solely to provide or improve user-facing features that you intentionally enable in Orange Potato. This includes authenticating your Orange Potato account through Google Sign-In, identifying the YouTube channel connected to your workspace, and supporting requested YouTube publishing functionality. We do not use Google user data for advertising, data brokerage, or general-purpose AI model training.

We share personal data with sub-processors strictly as necessary to provide the Service, including payment processors, hosting and storage providers, database and infrastructure providers, analytics providers, and AI model providers used to deliver requested product features. Google user data is not transferred, disclosed, or sold to third parties except as needed to provide or secure the user-facing functionality you requested, or where required by law.

We maintain administrative, technical, and organizational safeguards designed to protect personal and sensitive data against unauthorized access, alteration, disclosure, or destruction. These safeguards include HTTPS/TLS for data in transit on our production service, encryption for connected-account tokens and other sensitive secrets at rest, restricted access controls, and one-way password hashing for credential-based logins.

User Content and Google user data are not used by Orange Potato to train general-purpose machine learning models. Where user content is transmitted to AI model providers to deliver requested product features, Orange Potato configures those services and contracts to prohibit training use where offered and applicable.

You have the right to access, rectify, port, and delete your personal data, and to object to certain processing activities where applicable. You may also revoke Orange Potato's access to Google services through your Google account permissions at any time. To exercise rights with Orange Potato, contact privacy@orangepotato.app. We will respond within thirty (30) days.

We use strictly necessary cookies for session management and authentication, and analytics technologies for aggregate product analytics and service performance. Non-essential analytics may be limited without degrading core account functionality.

Account and content data are retained for the duration of your subscription plus a 90-day grace period unless a shorter or longer period is required for security, legal compliance, or dispute resolution. Financial records required for tax or accounting compliance may be retained for up to seven (7) years. Where Google user data is no longer needed for the enabled feature, we delete it or stop using it in line with our retention practices and applicable law.

Personal data may be stored or processed in the United States and other jurisdictions where Orange Potato or its service providers operate infrastructure. Where required, Orange Potato relies on appropriate contractual and technical safeguards for cross-border data handling.

If Hehl Holdings LLC receives a request for user data from a government agency, law enforcement authority, or other public authority, we review the request for legal validity before disclosing any information. We limit any disclosure to the minimum data required by applicable law, document the request and our response internally, and may challenge or seek to narrow requests that appear unlawful or overly broad where appropriate.

The Service is not directed to children under 18. We do not knowingly collect personal data from children. If you believe we have collected data from a child, contact privacy@orangepotato.app and we will delete it promptly.

We may update this Privacy Policy periodically. Material changes will be communicated via email at least thirty (30) days prior to taking effect.