Privacy policy

Version 2026-09-24. See also the terms.

Who we are

Poplu is run by Cikku.ai, [registered address], Malta ("we"). We are the controller of the personal data described here. For anything about your data, write to isaac.grech@qwikcallr.com.

What we hold

• Your account: the business name, website, time zone, your email address, your name if you give it, and your password stored as a one-way hash we cannot read.
• Your brand material: the pages, documents, marketing plans and photos you give us or point us at, and the brand profile Poplu builds from them.
• What Poplu writes for you, and what you do with it: which posts you approve, change, throw out, publish or boost.
• Your connected pages and ad accounts: which ones are connected, and the numbers they report (reach, views, likes, comments, clicks, ad spend).
• Comments and reviews on your pages and your Google listing, including the name of the person who wrote them, so Poplu can draft your replies.
• Security and usage records: the IP address and times you sign in, sign-in attempts, and how much of your monthly allowance you have used.
• Emails we send you, and whether they were sent.

Why we use it

• To provide Poplu to you (our contract with you): building your brand profile, writing and designing your posts, publishing and boosting what you approve, showing your results, and drafting replies.
• To keep it safe (our legitimate interest in a secure service): signing you in, stopping abuse and keeping a record of admin actions.
• To make Poplu better (our legitimate interest in improving the service, which you also agree to in the terms). See the next section.
• To send you the emails you choose in Settings: a week ready to approve, new comments and reviews, and a monthly summary.

How we improve Poplu

We study the posts Poplu writes for every business on the platform: the wording, the design, the platform, whether the business kept or threw out the post, and how it did once published. We use what we learn to change how Poplu writes, designs and schedules posts for everyone.

• We study it with the business name, website and email removed. Each business is replaced by a number. The post text itself is kept, because that is what we learn from, so it may still mention your business.
• We leave out the people who comment on or review your pages. Their names and words are never included; only the number of comments is.
• We never put one business's posts, photos or brand material into another business's adverts.
• We do not sell your data. We do not give it to anyone to train their AI models.
• You can ask us to leave your business out of this at any time, by email, without closing your account.

Who else handles it

These companies process data for us, only to run Poplu:

• Vercel runs the app (Dublin, Ireland).
• Supabase holds the database and your files (Frankfurt, Germany).
• Anthropic writes the copy and reads your photos and documents (United States).
• kie.ai makes images for posts that need one. So they match your look, it may be shown up to three of your own photos as a style reference, never one flagged for a face, a logo or readable text.
• Zernio connects your pages and ad accounts, publishes what you approve and reports the numbers. Where set up, Upload-Post or Postiz may do the publishing instead.
• Apify reads the public social pages you ask us to learn from, and, for the Field, public Instagram and TikTok posts under your trade's hashtags. Nothing of yours is sent to read those.
• Google provides your listing's reviews and rating (Places), and the fonts the pages use, which means your browser contacts Google when a page loads.
• Resend sends our emails.

Where one of them handles data outside the European Economic Area, the transfer is covered by an adequacy decision or the European Commission's standard contractual clauses.

When you publish or boost a post, it goes to the platform you chose (Instagram, Facebook, LinkedIn, Google), and that platform's own terms and privacy policy apply to it.

How long we keep it

• Your account and material: while your account is open. When you ask us to close it, we delete it within 30 days, apart from anything the law makes us keep, such as billing records.
• Records of background work, including what it cost: 14 days.
• Sign-in sessions: up to 30 days.
• The copies we study to improve Poplu, with names removed: up to 24 months.

Cookies

We use one cookie, and only to keep you signed in. We do not use tracking or advertising cookies.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to move it elsewhere, or to stop or limit using it, including leaving your business out of how we improve Poplu. Write to the address above and we will answer within a month. If you are not happy with our answer, you can complain to Malta's Information and Data Protection Commissioner (idpc.org.mt) or to the regulator where you live.

Changes

If we change this policy in a way that affects what you agreed to, we will tell you in Poplu and ask you to accept it before it applies to you.