Privacy Policy
Effective August 24, 2026 · Last updated August 24, 2026
Calluna is a social media tool for small businesses, operated by Calluna Labs, a California corporation. This policy explains what we collect, why we collect it, who else can see it, and how to get it back or delete it. We have tried to write it in plain language rather than legal boilerplate.
The short version
- Your content is yours. We do not sell it, and we do not use it to train AI models.
- Each business runs on its own isolated instance. We do not pool one customer's content with another's.
- We connect to social platforms only with your permission, only to the accounts you connect, and only to do what you approve.
- You can export everything and ask us to delete it.
What we collect
Account information. Your name, email address, and the business you belong to. Sign-in is handled by our identity provider, which stores your password; we never see it.
Content you create or upload. Posts, captions, replies, photos, notes, voice rules, and anything else you put into Calluna.
Connections to social platforms. When you connect an account (Instagram, Facebook, LinkedIn, Bluesky, and others), the platform gives us an access credential for that account. We store it encrypted and use it only to read the information you asked for and to publish what you approve. We never receive or store your platform password.
Information from those platforms. Depending on which accounts you connect and what you ask for: your account and page identifiers, posts you have published, comments and mentions on them, and performance figures such as reach and engagement.
Records of activity. Calluna keeps a permanent, sealed record of actions taken in your instance, including who approved what and when. If an entry were ever altered, the record would show it. This is a product feature; it is how you can show that nothing published without a person approving it.
Technical and usage data. Log data such as timestamps, request paths, and error information, used to keep the service running and secure.
How we use it
- To provide the service: drafting posts in your voice, scheduling, publishing what you approve, and showing you results.
- To keep your own instance's assistant tuned to your business, using your own history and your own edits.
- To maintain the approval record and provide exports.
- To secure the service, prevent abuse, debug problems, and meet legal obligations.
Artificial intelligence, stated plainly
Your Content means everything you put into Calluna or that Calluna gathers for you: drafts, approved posts, images, the history of your connected accounts, your voice rules, and your approval decisions.
We do not use Your Content to train, fine-tune, evaluate, or improve any AI model, whether ours or a third party's. We do not sell it and we do not share it for advertising. Those are separate promises and we make all of them.
Drafting runs one of two ways, and the application tells you which applies to your instance. Where we host the model ourselves, Your Content is never transmitted to any third-party model provider. Where drafting uses a third-party inference provider, we contract for terms that prohibit training on customer data and require zero retention, and we name that provider in our subprocessor list.
Calluna learns your voice by keeping an editable profile of your preferences and by referring back to your own past posts when it drafts. That is retrieval and a stored profile scoped to your business, not model training, and you can read and edit the profile at any time.
If we ever change this commitment, the change will apply only to content submitted after the change, and we will tell you in advance. We will not apply a new use to content you already gave us.
Nothing is published by AI. A person on your team approves every post and every reply before it leaves Calluna.
Who else sees your data
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We use a small number of service providers who process data on our behalf, under contract, only to run Calluna:
- Cloud hosting and storage, which is where the service and your data live.
- Our identity provider, which handles sign-in and account security.
- An AI inference provider, where drafting is not handled inside your own instance, under no-training and zero-retention terms.
- Email delivery, for the notifications you have turned on.
The social platforms you connect. When you approve a post, we send it to the platform you chose, and that platform's own terms and privacy policy govern what happens to it there. This includes Meta Platforms (Instagram and Facebook), LinkedIn, and any other network you connect. We use the data those platforms return only to operate Calluna for you, in keeping with each platform's developer terms.
We keep a current list of these providers and will give it to any customer who asks. If we add or change one in a way that affects your data, we will tell you at least ten days beforehand so you can raise an objection.
We may also disclose information if the law requires it, or to protect the rights and safety of people using Calluna.
Where your data lives, and for how long
Calluna is operated from the United States. We keep your content for as long as your account is active. When you close your account, we delete your content and connections within 30 days, except where we must keep something longer to meet a legal obligation. Backups are purged on a rolling schedule. The approval record is designed to be permanent for as long as your account exists, because its usefulness depends on staying unchanged; it is deleted with the rest of your data when you close your account.
Tracking, and how we answer Do Not Track
We do not track you across other companies' websites, and we do not allow anyone else to track you on ours. Calluna carries no advertising trackers and no third-party analytics that follow people between sites. Because we do not do the tracking that Do Not Track was designed to prevent, a Do Not Track signal from your browser changes nothing about how we behave. We honor Global Privacy Control signals as opt-out requests wherever they apply, even though we do not sell or share personal information.
Your rights
If you are a California resident, the CCPA gives you the right to know what personal information we hold about you, to receive a copy of it, to correct it, to delete it, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined by the CCPA, so there is nothing to opt out of. Residents of other states with similar laws have comparable rights. We honor all of these requests from everyone, wherever you live, rather than sorting by jurisdiction.
To exercise any of these rights, email admin@hicalluna.com. We will verify your request by confirming you control the account, and respond within 45 days. You can also export your data yourself from inside Calluna at any time. Instructions for deleting your data are on our data deletion page.
Security
Each business's data is isolated from every other business's. Platform credentials are encrypted at rest. Access to production systems is limited to the people who need it. No system is perfectly secure, and we will tell you promptly if a breach affects your data.
Children
Calluna is a business tool and is not directed to anyone under 16. We do not knowingly collect information from children.
The last twelve months
In the preceding twelve months we have not sold personal information, have not shared it for cross-context behavioral advertising, and have not used or disclosed sensitive personal information beyond the purposes described here. We review this policy at least once a year and re-date it even when nothing has changed.
Changes to this policy
If we change this policy in a way that materially affects how we handle your information, we will email account holders and update the date at the top before the change takes effect.
Contact
Calluna Labs
admin@hicalluna.com