Privacy Policy

1. Who We Are

Naptic LLC is a Florida limited liability company located at 7901 4th St N, Suite 300, St. Petersburg, FL 33702, USA. You can reach us at jordan@synapticstack.ai.

2. Scope

This policy applies to data we process while operating our services, including (a) Naptic (our AI-character content engine for TikTok), (b) the managed AI agent services we run for client businesses — which can include outbound SMS / text messaging on the client's behalf (see Section 11) — our website at synapticstack.ai, and our integrations with third-party platforms such as TikTok, Twilio, LinkedIn, and Instagram. Sections 3 through 10 below address our TikTok-integration practices specifically; Section 11 addresses our managed-service SMS practices; Section 12 addresses our LinkedIn and Instagram social publishing practices.

3. Information We Collect

In connection with our TikTok integration, we collect and process only the data required to publish AI-generated content to Naptic-owned TikTok accounts:

• OAuth credentials. When an authorized Naptic operator connects a TikTok account to the Service, TikTok provides us with an access token and refresh token. These tokens authorize the Service to act on behalf of that specific TikTok account within the requested scopes.
• Basic account information. Through theuser.info.basic scope, we receive the connected account's open ID, display name, and avatar URL.
• Content metadata. For each post the Service publishes, we store the source video file, caption, AI-generation disclosure flag, the publish ID returned by TikTok, and the resulting post status.
• Operational logs. Standard application logs (timestamps, request IDs, error messages) used to operate and debug the service.

We do not collect personal information about TikTok viewers, followers, commenters, or any other third-party end users, and we do not request scopes that would expose such data.

4. Scopes We Request

The Service requests only the TikTok scopes necessary to publish content:

• user.info.basic — to identify which Naptic-owned account a token is associated with.
• video.upload — to upload video files into the connected account's draft area.
• video.publish — to publish uploaded videos as posts on the connected account.

5. AI-Generated Content Disclosure

All content the Service publishes is generated with the assistance of artificial intelligence. We mark every TikTok post with the platform's AI-generated content flag (is_aigc=true) so that viewers can identify it as AI-generated, consistent with TikTok's policies on synthetic media.

6. How We Use Information

• To authenticate the Service with the connected TikTok account and post content on its behalf.
• To track publish status and surface failures to internal operators.
• To comply with TikTok's developer policies, including content disclosure requirements.
• To operate, secure, and improve our internal tooling.

7. How We Store and Protect Information

TikTok OAuth tokens are stored in AWS Secrets Manager with encryption at rest and TLS in transit, and access is restricted to authorized Naptic systems and personnel. Content metadata is stored in private internal systems. We follow industry-standard practices to safeguard the information we hold, but no system is perfectly secure.

8. Sharing of Information

We do not sell personal information, and we do not share it with third parties for their own marketing. We share information only with:

• TikTok. Content, metadata, and authenticated requests are sent to TikTok in order to publish posts on the connected account, in accordance with TikTok's Terms of Service and developer policies.
• Infrastructure providers. Cloud services such as Amazon Web Services that host our systems and store credentials, under their respective data-processing terms.
• Legal compliance. Where required by law, regulation, legal process, or governmental request.

9. Data Retention

We retain OAuth tokens for as long as the integration is active. If an account is disconnected — by revoking access in TikTok's settings, rotating credentials, or contacting us — we delete the associated tokens from our systems. Operational logs and content metadata are retained for the period necessary to operate and audit the service.

10. Your Choices

Because Naptic only connects accounts that it owns or operates, the primary control available is to revoke Naptic's authorization through TikTok's account settings, or to contact us directly to disconnect a specific account. Revoking authorization will immediately stop new posts from being published through the Service for that account.

11. SMS / Text Messaging — Naptic LLC as Managed Service

When Naptic LLC operates an AI agent service for a client business (for example, a fitness or wellness studio), Naptic LLC may send outbound SMS / text messages to that client's customers on the client's behalf, and receive inbound SMS replies. This section describes how Naptic LLC handles mobile / SMS data for those managed-service engagements.

11.1 Categories of messages

Outbound SMS we may send on a client's behalf:

• Customer care. Class, appointment, or booking reminders, confirmations, and follow-up to support inquiries.
• Conversational follow-up. AI-agent responses to inbound questions about the client's services, schedule, location, pricing, and intro offers.
• Re-engagement. Periodic check-ins to customers with a prior service relationship with the client (for example, dormant-customer winback).

We do not send purely promotional or mass-marketing campaigns through this channel.

11.2 Opt-in

We send SMS only to phone numbers that have provided explicit opt-in consent through one of the following mechanisms:

• The client's booking or intake form, with a clearly labeled SMS-consent checkbox that discloses approximate message frequency and that carrier message + data rates may apply.
• An explicit "JOIN" keyword reply to an Instagram (or other inbound channel) where SMS-consent language was presented before the keyword.
• Verbal consent captured by client staff during an in-person interaction, logged in the client's CRM with timestamp and the capturing staff member's identity.

Mobile opt-in information collected for one client is used solely to deliver messages on that client's behalf. It is never reused for another client and is never used for any other Naptic LLC product or third-party purpose.

11.3 Opt-out

You can opt out of SMS from any Naptic LLC-operated client agent at any time by replying with any of the standard opt-out keywords: STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, or QUIT. You will receive a single confirmation message and no further SMS will be sent on that client's behalf. Reply START or UNSTOP to resume.

For help at any time, reply HELP to receive a brief description of the service and a contact channel.

11.4 Sharing

Mobile information (phone numbers, SMS consent records, and message data) will not be shared with third parties or affiliates for marketing or promotional purposes. We share mobile data only with:

• Twilio Inc. and downstream telecom carriers for the purpose of message delivery.
• The client business whose service the messages are sent on behalf of, so the client can maintain its own customer relationship.
• Infrastructure providers (Amazon Web Services) that host our systems, under their respective data-processing terms.
• Legal compliance where required by law, regulation, legal process, or governmental request.

11.5 Message frequency, fees, retention

Frequency varies by service category. Typical client engagements send between 50 and 3,000 message segments per month per client, distributed across all opted-in recipients. Messaging and data rates may apply per your carrier.

We retain SMS conversation records and opt-in / opt-out evidence for the duration of the client engagement plus a reasonable audit-trail period (typically 12 months after engagement end) to comply with TCPA, state SMS-consent laws, and similar regulatory requirements. After that period, records are deleted unless an active dispute or legal hold requires longer retention.

12. Social Publishing (LinkedIn and Instagram)

Our social publishing service helps a client business plan, approve, and publish posts to its LinkedIn Page, to the LinkedIn profiles of its people, and to its Instagram professional account. Each person or Page admin connects their own account through LinkedIn's or Instagram's own sign-in screen at synapticstack.ai. We never ask for, see, or store LinkedIn or Instagram passwords, and we never let one person's connection be used to manage someone else's account.

12.1 Information we receive from LinkedIn

• Connection data. An access token and, where LinkedIn issues one, a refresh token; your LinkedIn member ID; your name, profile photo URL, and email address from LinkedIn sign-in; and the list of LinkedIn Pages you administer and your role on each.
• Posts we publish. The text, images, and documents of posts you approve, and the LinkedIn IDs LinkedIn returns for them.
• Comments on those posts. The comment text and the commenter's name, headline, and profile photo, so you can see and respond to comments on your own posts inside our app.
• Analytics. Aggregate statistics for your Page and your posts, such as impressions, reactions, comments, shares, and follower counts.

LinkedIn permissions we may request, only for the features you use: openid,profile, email, w_member_social,w_member_social_feed, r_member_postAnalytics,w_organization_social, r_organization_social,rw_organization_admin.

12.2 Information we receive from Instagram

• Connection data. An access token, your Instagram professional account ID, username, and profile picture.
• Posts we publish. The media and captions of posts you approve, and the media IDs Instagram returns.
• Comments and insights. Comments on your own posts (text, the commenter's username, and time) so you can read and reply to them, and aggregate insights for your account and posts.

Instagram permissions we may request, only for the features you use:instagram_business_basic, instagram_business_content_publish,instagram_business_manage_comments, instagram_business_manage_insights.

12.3 How we use it, and what we never do

We use this information only to publish the posts you approve, show you the comments and analytics for your own Page, profile, or account, remind you before a connection expires, and operate and secure the service. Comments and analytics are shown only to the client team connected to that Page, profile, or account.

We do not:

• sell, rent, or license LinkedIn or Instagram data to anyone;
• use it for advertising, ad targeting, audience building, sales prospecting, lead generation, recruiting, or to enrich a CRM or marketing tool;
• export it or hand it to anyone outside our app, including in files or reports for clients;
• combine it with other data to build profiles of people;
• use it to train artificial intelligence models.

12.4 Storage and retention

Tokens are stored encrypted in AWS Secrets Manager; other records are stored in private AWS systems in the United States, encrypted at rest and in transit. We keep each kind of data only as long as LinkedIn and Meta allow, and no longer than we need it:

• Profile details of people who comment on your posts (name, headline, photo): up to 24 hours, as a display cache only.
• Comment text and other member activity from LinkedIn: up to 48 hours.
• Your Page's own posts and activity from LinkedIn: up to 6 months while your Page is connected.
• Aggregate analytics: up to 12 months.
• Tokens, account IDs, and a record of what we published: while your account is connected.

12.5 Disconnecting and deleting your data

You can disconnect at any time by removing Naptic from LinkedIn (Settings, Data privacy, Permitted services) or from Instagram (Settings, Website permissions, Apps and websites), or by emailing us. Once we learn an account is disconnected, we stop publishing to it and delete its tokens and the LinkedIn or Instagram data we hold about it within 30 days, except a minimal record that a deletion took place.

Data deletion requests. To have us delete the data we hold from your LinkedIn or Instagram account, emailjordan@synapticstack.aiwith the subject "Data deletion" and your LinkedIn profile URL or Instagram username. We confirm by email and complete the deletion within 30 days.

12.6 Sharing

We share this information only with LinkedIn or Meta, to publish posts and read comments and analytics on your behalf; with Amazon Web Services, which hosts our systems; with the client team connected to that Page, profile, or account, inside our app; and where required by law. Naptic is not affiliated with or endorsed by LinkedIn Corporation or Meta Platforms, Inc.

13. Children's Privacy

Our services are not directed to children under 13, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Material changes will be highlighted on this page or communicated through other reasonable means.

15. Contact Us

Questions about this Privacy Policy or our data practices? Reach us at:

Naptic LLC
7901 4th St N, Suite 300
St. Petersburg, FL 33702
USA
jordan@synapticstack.ai