Mica Privacy Policy

Effective Date: June 1, 2026 Last Updated: September 15, 2026

This Privacy Policy explains how GraniteAI, LLC ("GraniteAI", "we", "us", or "our") collects, uses, shares, and protects personal information in connection with Mica (the "Service") — the autonomous social media platform marketed at graniteai.co/mica and delivered at social.graniteai.co.

This policy is written for U.S.-based readers and is designed to comply with the California Consumer Privacy Act / California Privacy Rights Act ("CCPA/CPRA"), the FTC Act, and equivalent U.S. state privacy laws (including Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, and Texas TDPSA) to the extent they apply. If you are outside the U.S., do not use the Service.

By using the Service, you confirm you have read this policy.

1. Who We Are and Whose Information This Covers

GraniteAI is the business that determines the purposes and means of processing the personal information described here. We sell to small businesses ("Customers") under the Mica brand. Information covered by this policy comes from four groups of people:

This policy applies whether you arrive at our website, request a free sample pack, sign up for a trial, become a paying Customer, or appear in content a Customer uploads.

2. What We Collect and Why

We do not sell personal information for money. We do not run cross-context behavioral advertising. The categories below are written using CCPA/CPRA's vocabulary so you can map them to the rights described in Section 6.

2.1 Information you give us directly

2.2 Information we collect automatically when you use the dashboard

2.3 Information generated by the Service about your tenant

• Generated content (captions, slides, voiceovers, video renders) — produced by AI from your inputs.
• Telemetry — model used, input/output token counts, cached token counts, pass duration, and pass success/failure. We use this to operate the Service and track costs.
• Editorial history — a 20-entry rolling log of topics, intents, and "signature phrases" used in recent posts, so the AI doesn't repeat itself.
• Judge / claim-guard logs — pass/fail records and per-axis scores for our quality gates.

2.4 What we deliberately do NOT collect

• We do not collect government IDs, Social Security numbers, financial account numbers, precise geolocation about you as a user (we only see EXIF from photos you upload), health information, or information about your sexual orientation, religion, race, or political views.
• The only biometric information we process is the voice sample you optionally provide for voice cloning, and the face matching described in Section 2.8, which runs only for Customers who have turned it on themselves and agreed to it in their settings. For every other Customer, no photo is sent to a face-recognition service at all.
• We do not run third-party advertising or ad-retargeting trackers on the dashboard. We do use a first-party product-analytics and session-replay tool (PostHog) to understand and improve how the Service is used; that is described in Section 9.
• We do not buy personal information from data brokers.

If you upload photos that incidentally contain sensitive information (e.g., a screenshot of your business bank account, a photo of an employee's medical chart, a customer's driver's license), our automated preflight flags many such cases and quarantines the photo. But the safest practice is not to upload them in the first place.

2.5 Prospective customers and sample packs

If you ask us for a free sample content pack before signing up, for example through our /sample funnel, we collect your name, email, and business information, and we crawl the public business website you give us to build the sample (see Section 3). We may keep these prospect details to follow up with you about your evaluation. You can ask us to delete them at any time by writing to privacy@graniteai.co; otherwise we delete or de-identify them once the evaluation concludes.

2.6 Instagram performance data (Mica Social Media Analyzer only)

This section applies only if you subscribe to Mica Social Media Analyzer. It does not apply to any other plan.

When you connect your Instagram professional account, we collect:

• An Instagram access token issued by Meta when you authorize our app. We store it in Google Secret Manager, use it only to read the data described below, and refresh it on a schedule. We never receive or store your Instagram password.
• Reel metadata for your organic Reels: the media ID, caption, media type, permalink, publication timestamp, like count, and comment count.
• Reel performance metrics read from Meta's Insights API at intervals after each Reel is published: views, reach, saves, shares, and total interactions, plus additional engagement metrics where Meta provides them.
• Your follower count at the moment of each measurement, read from your account rather than from a Reel. We store it alongside each snapshot because it is the denominator that makes reach comparable between a Reel you posted when you had 400 followers and one you posted at 4,000. We keep the number only, attached to that point in time. We never retrieve or store who your followers are.
• The raw API responses Meta returns for the calls above, stored as received so that a reported number can always be traced to the response it came from.

What this does not include, by design: we do not read your direct messages, the identities of your followers or the accounts you follow, information about individual people who viewed or engaged with your Reels, your advertising or paid campaign data, your Facebook Page, or any account other than the Instagram accounts you connect. Everything we store is a count: how many people saw, saved, or shared a post, and how many followers you had at the time. None of it identifies anyone in your audience.

We do not publish, post, delete, or change anything on your Instagram account through this product. The access is read-only.

2.7 Google Business Profile data (Mica Social Media Analyzer only)

This section applies only if you subscribe to Mica Social Media Analyzer and connect your Google Business Profile. It does not apply to any other plan.

When you connect your Google Business Profile, we collect:

• A Google access token and refresh token issued when you authorize our app with the permission Google describes as "Manage your Business Profile on Google". We store them in Google Secret Manager, use them only to read and, where you have turned the feature on, write the data described below, and renew them on a schedule. We never receive your Google password.
• Your profile's performance metrics, read once a day: impressions on Google Search and Google Maps, calls, direction requests, website clicks, and the search terms that led people to your profile. We keep the daily history so you can compare periods.
• Your profile's business information: name, address, phone, hours, categories, attributes, and description.
• Your profile's reviews, including reviewer display names and review text, and any replies.
• The raw API responses Google returns for the calls above, stored as received so that a reported number can always be traced to the response it came from.

We read this data for the profile you own or manage and show it back to you inside your own AI assistant and in your dashboard. We do not read any other profile. We do not publish, post, reply, or change anything on your profile unless you turn that feature on, and each such feature is off by default.

Google's use of this data is governed by the Google Privacy Policy at https://policies.google.com/privacy. Our use complies with the Google API Services User Data Policy, including the Limited Use requirements.

2.8 Face matching in uploaded photos (opt in, off by default)

Some Customers want the people in their photos named in a caption, so that a post about a job says who did the work. Doing that means recognising a face, which is biometric processing, so it is off unless you turn it on.

Who this applies to. Face matching runs only for a Customer who has switched on the Facial recognition toggle in their account settings and agreed to the consent statement shown there. Until then your photos are never sent to the face-recognition service, no face is detected in them, and nothing about anyone's face is computed or stored. The check is a consent record in our database, read in code before the service is called, and it fails closed: no record, or a record we cannot read, means no processing.

What happens once you turn it on. When a photo is uploaded, it is sent to a face-recognition service we run ourselves. The service compares faces in the photo against reference images of the people who have been enrolled, and returns a name only for a person it recognises with enough confidence. Enrolled people are held in one shared roster, so a photo is compared against every enrolled person rather than only the people from your business. Anyone the service does not recognise comes back as an unidentified face and is never named. The names it returns are stored with the photo and may be used in the caption of a post you publish.

Consent and withdrawal. Switching the toggle on records who agreed, the exact wording they agreed to, and when, and that record is what permits the processing. You can switch it off on the same settings page at any time, or write to privacy@graniteai.co and we will do it for you. Switching it off stops all further face processing immediately. Removing a person's reference images from the roster, which removes their stored face data, is a separate request to the same address, because those images live inside the recognition service rather than in the Mica database; we do that within 30 days of the request.

What we do not do. We do not identify members of the public, customers, or anyone else who has not been enrolled. We do not build a face database across tenants. We do not use faces for advertising, and we do not share face data with any third party.

2.9 Mica Intelligence Signal (market data over MCP)

Mica Intelligence Signal is a separate subscription that answers questions about your market. You connect it to an AI client of your choosing, and that client asks it for figures.

What it serves is public government data: business counts, building permits, storm events, risk indices and similar series from sources such as the Census Bureau, NOAA and FEMA, aggregated to a county or ZIP-code area. It holds no personal information about anyone, and nothing about your own customers or your own performance is in it.

The personal information involved is your own business identity. Every answer is scoped to you, so it carries your business name, your industry code and your service area back to the AI client you connected, along with the figures you asked for. That client's provider receives all of it, as described in Section 7.

3. Sources of Personal Information

We get personal information from:

1. You, directly — what you type, upload, and configure.
2. Our identity provider, Clerk, when you sign in — name, email, and authentication metadata.
3. Our billing provider, Stripe (via Clerk Billing) — payment status and the last four digits of your payment card (we never see the full card).
4. Our AI subprocessor, OpenAI — model outputs (which we treat as Generated Content); OpenAI does not give us personal information about other people.
5. Connected social platforms (Facebook, Instagram, etc.) through Publer — limited account metadata needed to publish (e.g., the account ID, account name, posting status).
6. Your business website, which we crawl with a headless browser at onboarding (and when you request a sample pack) to extract your business profile: the description, services, and other public details you have published there.
7. Google Business Profile, via the Google Places API. Where available and with your authorization, we retrieve your business's public profile data, including its star rating and public customer reviews (reviewer names and review text). We may feature short review excerpts in generated posts. In this respect Google is both a source of information and a subprocessor (see Section 7).
8. Meta's Instagram Graph API, directly, if you subscribe to Mica Social Media Analyzer and connect your Instagram professional account. This is a separate connection from the publishing integration in item 5: it uses an access token you grant to our own Meta app, and it reads performance data rather than publishing content. See Section 2.6.
9. Google's Business Profile APIs, directly, if you subscribe to Mica Social Media Analyzer and connect your Google Business Profile. This is a separate connection from the Places lookup in item 7: it uses a token you grant to our own Google app, and it reads the owner's view of your profile (performance metrics, business information, reviews) rather than the public listing. See Section 2.7.

4. How We Use Personal Information

We use the information described above to:

• Operate and provide the Service, including running the daily content-generation cron, publishing your content through Publer, and giving you a working dashboard.
• Bill you and manage subscriptions and trials.
• Improve the Service — fix bugs, tune prompts, measure cache-hit rate, track which configurations produce better content. We do this using aggregated telemetry and limited samples, not by training foundation models on your content (see Section 5.2).
• Communicate with you — operational emails (billing receipts, trial-ending notices), security notices, and (only with your opt-in or where allowed by law) product update emails.
• Detect and prevent abuse, fraud, and violations of our Terms, including content the claim-guard flags as risky.
• Comply with law and respond to lawful requests from authorities.
• Enforce our agreements and defend ourselves in legal disputes.

We do not use personal information for automated decision-making that produces legal or similarly significant effects on individuals.

5. AI Processing — Specific Disclosures

Because Mica is, at its core, an AI-driven service, we give you the specifics.

5.1 Who runs the models

Our content-generation, vision, judge, and claim-guard passes run through OpenAI's API. Voiceovers for Reels are generated with the open-source Chatterbox model hosted by DeepInfra, reached through Hugging Face Inference Providers; we send the voiceover text and, if you choose your own voice, your reference recording, which DeepInfra stores as a voice profile for your account. Word-level caption timings come from OpenAI's transcription API, which receives the generated voiceover audio, not your recording. Scene images a photo cannot cover are generated with OpenAI's image API. None of these providers may use your data to train their models under the settings we use.

5.2 No training on your content

We send your Customer Inputs to OpenAI's API with the standard API setting that excludes the data from being used to train OpenAI's models. We do not separately license a copy of your data to any AI vendor for model training. If we ever change this, we will update this policy and the Terms, give you notice, and let you opt out.

5.3 What the AI sees

• The vision pass sees photos you upload and writes a structured classification (subject, scene type, quality, privacy flags such as "screen with data" or "competitor branding", tags).
• The carousel and reel writers see your brand config, ICP, positioning, intents, pillars, prior topics, and a structured photo summary — and produce slide copy or a voiceover script.
• The judge and claim-guard see the writer's output and score it against rules we define.

5.4 Caching and the layered-context architecture

To reduce cost, we order prompts so that the static prefix (tenant configuration, daily snapshot) can be cached by the API provider. Cached prompts are still your data; caching is operational, not a separate use.

5.5 No persona attribution to real people

The Service may write in a "voice influenced by" a style direction you choose, but it does not generate content attributed as the words of a real, named third-party person.

6. Your Rights and How to Exercise Them

If you are a California resident, you have specific rights under CCPA/CPRA. Residents of Virginia, Colorado, Connecticut, Utah, and Texas have very similar rights under their state laws. We extend these rights to every U.S. resident because it is simpler and the right thing to do.

6.1 Your rights

• Right to know what personal information we have about you, where we got it, why we have it, who we shared it with, and to receive a copy.
• Right to delete the personal information we have about you, subject to exceptions in law (for example, we must keep payment records for tax purposes).
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing. We do not sell personal information for money and do not share it for cross-context behavioral advertising. You can still send us this signal; the answer will be "we already aren't."
• Right to limit use of sensitive personal information. The only sensitive personal information we knowingly collect is the optional voice sample for voice cloning; you can ask us to stop using it and delete it.
• Right to non-discrimination for exercising these rights — we will not deny service, charge a different price, or degrade quality because you asked.
• Right to an authorized agent to submit a request on your behalf.

6.2 How to submit a request

Email privacy@graniteai.co with the subject "Privacy Request" and tell us which right you want to exercise. We will:

• Acknowledge within 10 business days.
• Verify your identity using information you already have with us (account email plus, where needed, additional non-burdensome verification).
• Respond substantively within 45 calendar days of receipt. If we need more time, we will tell you and may take up to 45 additional days.

Deletion is carried out by us by hand rather than by a button in the dashboard. Account users can cancel from the dashboard and ask for full deletion by writing to privacy@graniteai.co from the address on the account; we will remove your tenant and the personal information tied to it within 30 days of the request, as Section 8 describes, keeping only what an exception in law requires, such as payment records for tax purposes. If you have connected Instagram or a Google Business Profile, you can disconnect those yourself at any time, which is described in Sections 6.5 and 6.6 and takes effect immediately.

6.3 If you are a subject in an uploaded photo

If you are not a Customer of ours but you believe a photo of you (or other personal information about you) is in our system because someone else uploaded it, write to privacy@graniteai.co. We will work with the relevant Customer to remove it, subject to legitimate operational needs and law.

6.4 If you disagree with our response

You can contact us to ask us to reconsider, and you can lodge a complaint with your state's Attorney General or, if you are in California, the California Privacy Protection Agency.

6.5 Disconnecting Instagram and deleting your Instagram data

This section applies to Mica Social Media Analyzer and describes how to revoke our access to your Instagram account and have the data we collected from it deleted.

To revoke access from Instagram. Open Instagram, then Settings and privacy, then Website permissions, then Apps and websites. Remove GraniteAI from the list. This invalidates our access token immediately and stops all further collection. Meta also notifies us when you do this, and we mark the connection revoked on our side, so nothing further is collected for that account even if the token were still usable. Your existing history stays until you ask us to delete it.

To have the collected data deleted, through Meta. If you make the deletion request through Meta rather than by email, Meta sends it to us directly and we act on it while the request is in flight. We delete the performance metrics, the Reel records, and the connection itself for the Instagram account named in the request. Meta then shows you a confirmation code and a link to a page on our site where you can check that the deletion finished.

To have the collected data deleted, by email. Email privacy@graniteai.co from the address on your account with the subject line "Delete Instagram data" and tell us which Instagram account it concerns. We will delete the access token, the Reel metadata, the performance metrics, and the stored raw API responses for that account, and confirm in writing. We complete these requests within 30 days, and normally much sooner.

Deleting your GraniteAI account deletes this data as well, on the schedule in Section 8. Nothing we delete affects your Instagram account itself: your Reels, their captions, and their engagement remain on Instagram, which is the system of record for them.

6.6 Disconnecting Google Business Profile and deleting that data

This section applies to Mica Social Media Analyzer and describes how to revoke our access to your Google Business Profile and have the data we collected from it deleted.

To stop reading, from our side. Open social.graniteai.co/analyzer/install and press Disconnect next to the location. Reading stops with the next run. The credential stays stored until you revoke it at Google or ask us to delete it, because other locations under the same Google account may still be connected.

To revoke access at Google. Open myaccount.google.com/permissions, find Mica by GraniteAI, and remove it. Google invalidates our token immediately. On our side the next scheduled read fails, and we mark every location under that grant as needing reconnection.

To have the collected data deleted, by email. Email privacy@graniteai.co from the address on your account with the subject line "Delete Google data" and tell us which Business Profile it concerns. We will delete the stored token, the daily metrics, the business information, the review copies, and the stored raw API responses for that profile, and confirm in writing. We complete these requests within 30 days, and normally much sooner.

Deleting your GraniteAI account deletes this data as well, on the schedule in Section 8. Nothing we delete affects your Business Profile itself, which remains on Google.

7. How We Share Personal Information

We share personal information only with the following categories of recipients, and only for the purposes identified:

A current, more detailed subprocessor list — with links to each subprocessor's privacy/security page — is available at social.graniteai.co/subprocessors (or by writing to privacy@graniteai.co).

We do not share personal information with marketing or advertising networks.

8. How Long We Keep Information

Published content on Facebook, Instagram, and other platforms is governed by those platforms' retention practices, not ours.

9. Cookies, Analytics, and Similar Technologies

We use cookies and similar technologies that are necessary to operate the Service:

• Session cookies set by Clerk to keep you signed in.
• CSRF tokens to protect form submissions.
• Functional preferences (e.g., last-viewed tenant).

We do not use third-party advertising or behavioral-advertising cookies, and we do not sell or share the data these technologies generate for cross-context behavioral advertising.

Product analytics and session replay (PostHog). We use PostHog, a product-analytics and session-replay tool, to understand how the Service is used and to improve it. PostHog captures usage events, page views, and session recordings of dashboard interactions; when you are signed in, it associates that activity with account identifiers including your name and email. PostHog also runs on our Mica marketing and funnel pages on graniteai.co to measure how prospective customers move through the funnel. We use this data for product improvement, customer support, and funnel measurement, never for advertising. PostHog is listed on our subprocessor page at social.graniteai.co/subprocessors.

You can control cookies through your browser. Blocking session cookies will prevent sign-in.

10. Security

We use technical and organizational measures designed to protect personal information, including encryption in transit (HTTPS to and from the dashboard and to our subprocessors), encryption at rest (provided by Neon and Vercel Blob), least-privilege access controls, separation of secrets via environment variables, banned-phrase guards and claim-guards on AI output, and monitoring through our hosting providers.

No system is perfectly secure. If we become aware of a security incident affecting your personal information, we will notify you and any required authority in accordance with applicable U.S. state breach-notification laws.

11. International Users; U.S.-Only Service

The Service is intended for U.S. users and U.S. businesses. Our infrastructure is hosted in the United States. If you access the Service from outside the U.S., you understand and consent that your information will be processed in the U.S., where data-protection laws may differ from those of your country. We do not currently offer the Service to E.U./E.E.A., U.K., Swiss, or Canadian residents, and these Terms and this policy are not drafted to comply with GDPR, U.K. GDPR, FADP, PIPEDA, or other non-U.S. regimes.

12. Children

The Service is for businesses. It is not directed to children under 13, and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, write to privacy@graniteai.co.

Customers are responsible for not uploading personal information about children (see Section 4.7 of the Terms).

13. Do Not Track and Global Privacy Control

The dashboard does not respond to browser "Do Not Track" signals, which have no common standard. We do not engage in the cross-site advertising tracking that DNT was designed to limit; our only analytics is the first-party product analytics and session replay described in Section 9. We do honor the Global Privacy Control (GPC) signal as an opt-out of sale/sharing where applicable — and, again, we do not sell or share personal information for cross-context behavioral advertising in the first place.

14. Changes to This Policy

We may update this policy from time to time. If we make a material change, we will notify you by email (to the address on file) and/or by an in-dashboard notice at least 15 days before the change takes effect, except where a shorter period is required by law. The "Last Updated" date at the top of the page reflects the most recent change.

15. Contact

To exercise your rights, ask a question about this policy, or report a concern:

• Email: privacy@graniteai.co
• General contact: guru@graniteai.co
• Postal: GraniteAI, LLC, Attn: Privacy — Mica, 145 Lakeside Dr, Manchester, NH 03104

For California residents, GraniteAI is the business under CCPA/CPRA.

Appendix A — CCPA/CPRA Disclosures at a Glance (last 12 months)