Privacy policy

Last updated 15 November 2026

This policy explains what personal data TinyBird collects, why, who else handles it, how long we keep it and how you can see, change or delete it. It applies to the TinyBird website and app and to the Threads accounts you connect to it.

Who we are

TinyBird is run by MAROTECH SOLUTIONS (registration no. [registration number to be added]), [business address to be added], Malaysia. We are the data user (controller) for the personal data described here, under Malaysia's Personal Data Protection Act 2010.

For anything about your personal data, email support@marotech.my.

TinyBird is not made, endorsed or run by Meta. Threads is a trademark of Meta Platforms, Inc.

What we collect

Your account

Your name, email address and password. We store the password only as a one way hash and cannot read it.
If you sign in with Google: your Google account id, name and email address, as Google shares them with us.
If you turn on two-factor sign in: the secret for your authenticator app, and your recovery codes, both stored encrypted.
The language and country you choose.
The workspaces you belong to and your role in each.

What you put in your workspace

Your personas: their names, the voice and topics you describe, example posts and settings.
Drafts, posts, carousels, photos you upload, the products and links you add, schedules and the notes you write.
The email addresses of people you invite to your workspace.

From Threads, when you connect an account

Your Threads profile: user id, username, name and the link to your profile picture.
The ids and links of posts we publish for you.
Insights for those posts: views, likes, replies, reposts, quotes and shares.
Profile numbers, read once a day: your follower count, and the views, likes, replies, reposts and quotes of your whole profile for each day.
The access token Threads gives us so we can post for you. It is stored encrypted and never shown to anyone.
Replies to your posts, only if we offer the replies feature in the future and you turn it on. We do not read replies today.

We ask Threads only for the permissions we use: your basic profile, publishing posts and reading insights. We never ask for or see your Threads or Instagram password.

Payments

Payments are handled by Billplz. We keep a record of each payment: the plan or credits bought, the amount, the method (card, FPX, DuitNow QR or e-wallet), the status, the Billplz reference and your receipt. If you pay by card, Billplz keeps the card details and tells us the card's last four digits, which we show you on your billing page. We never see or store your full card number. If a payment method asks for a phone number, we pass it to Billplz for that payment.

Usage and AI records

A record of each AI task: what kind of task it was, which model did it, how much text went in and out, the cost, how long it took, whether it worked, and the text it gave back.
Your credit balance and every credit used or added.
An activity log of actions in your workspace, such as who approved a post or turned auto-post on.
Technical data our servers record: IP address, browser type, the pages asked for and errors. We use it to keep the service secure, limit abuse and fix problems.

Cookies

We use only the cookies the service needs to work: a session cookie that keeps you signed in, a security cookie that protects forms, a "remember me" cookie if you choose it, a "remember this device" cookie if you tick it after a two-factor sign in, so this browser is not asked for a code for 30 days, and a language cookie that remembers the language you picked. Cloudflare, which protects the site, may set its own cookies to tell people from bots. We do not use advertising or tracking cookies.

When you contact us

If you write to us or use the contact form, we keep your name, email address and message so we can answer and keep a record of what we agreed.

When you join the waitlist

Before sign up opens, you can join our waitlist. We keep your email address, your name and type of business if you give them, the language of the page, and the record of your opt in: when you joined and when you confirmed your address from our email.

Why we use it

To run the service you signed up for: your account, your workspace, writing drafts, posting to Threads when you approve a post or turn on auto-post, and showing your results.
To bill you and keep payment records the law asks for.
To send you emails about your account: sign in codes, receipts, payment reminders, low credit warnings and notices when something was posted on its own. These are part of the service and are not marketing.
To keep the service safe: stopping spam and abuse, limiting sign in attempts and finding errors.
To answer you when you ask for help.
To tell you when sign up opens, if you joined the waitlist. We send one email to confirm your address and one when sign up opens, nothing else.
To meet the law and the rules of the platforms we connect to, such as Meta's Platform Terms.

We process your data on the basis of your consent, which you give when you sign up and connect an account, because we need it to provide the service you asked for, and where the law requires it. You can withdraw your consent at any time (see Your rights below); some of the service then stops working.

We do not sell your data, rent it or share it for advertising. We do not use your Threads data to build profiles of you or of anyone else, and we use the data of one customer only for that customer.

How AI handles your drafts

TinyBird writes drafts and makes AI images with AI models run by our AI model providers: one for text and one for images. To write or check a draft, we send the text model what that task needs: the persona's voice and topics, a few of your earlier posts as examples, the notes you give and our instructions. For an AI image we send the image model the description of the image. The models send back text or an image, which we store in your workspace.

We do not train or tune any AI model on your content, and we never put one customer's content into another customer's drafts.
We use our AI model providers through their business services, under terms that do not let them use what we send to train their models.
AI output can be wrong. Every draft waits for you to approve it, unless you turn on auto-post for a persona yourself.

Who else handles your data

We use these service providers to run TinyBird. Each handles personal data only to provide its service to us and only as we tell it to.

Provider	What for
Our AI model providers	Writing and checking drafts and making AI images
Our hosting provider	The servers, the database and the backups
Billplz	Payments by card, FPX, DuitNow QR and e-wallet
Brevo	Sending our emails
Cloudflare	Protecting the site, delivering it quickly and the bot check on our forms

We also exchange data with services you choose to use with TinyBird: Meta, when you connect Threads and we post for you; Google, if you sign in with Google; and Pexels, which receives only the search words when you look for a stock photo.

We may disclose data if the law requires it, for example to answer a valid court order, and we will tell you unless the law does not allow it.

Where your data is stored

Our servers and backups are in [data centre location to be added]. Some of our service providers, such as our AI model providers, Brevo and Cloudflare, may process data in other countries. When data leaves Malaysia, we use providers that protect it to a standard at least as high as Malaysian law asks, under written terms.

How long we keep it

Your account and workspace: while your account is open. When you delete your account, we act at once on every workspace only you belong to: its Threads data is deleted, nothing more is posted or written, and a paid plan stops renewing with its card agreement revoked. The account and its content stay closed for 30 days, then are removed from our live systems. Within those days you can email us to restore the account; Threads then has to be connected again.
Threads data: until you disconnect the account and delete its data, remove TinyBird in Threads, ask Threads to have it deleted, or delete your account. In each case it is deleted from our live systems at once.
Backups: our backups rotate. Data deleted from our live systems is gone from the backups within a further 30 days.
Payment records: while your workspace exists, and for 7 years after it is removed, as tax records. We then keep only the receipt number, the amount, the date, the payer's email address, the workspace name and our company details; nothing else about you.
Sign in codes: removed 1 day after they expire. Invites: removed 30 days after they are accepted, withdrawn or expire.
Messages to support: as long as we need them to help you and keep a record of what we agreed.
The waitlist: until you leave it, or 30 days after we send the invitations to sign up, whichever comes first. Then it is deleted. An address that is not confirmed within 7 days is deleted then.

Your rights

Under Malaysian law you can:

See the personal data we hold about you and get a copy.
Correct data that is wrong, out of date or incomplete. You can change your name and email in your profile yourself.
Take your data with you: ask for a copy in a common file format that you can move to another service.
Delete your Threads data or your whole account (see below).
Withdraw your consent to us processing your data, or ask us to stop processing that causes you harm.

Email support@marotech.my from the address you sign in with. We answer within 21 days. We may ask you to confirm who you are before we act. If you are not happy with our answer, you can complain to the Personal Data Protection Commissioner of Malaysia.

How to delete your data

In TinyBird: open Connections and choose Disconnect and delete my Threads data next to the account. You get a confirmation code and a status page.
In Threads: open Settings, Account, Website permissions and remove TinyBird. We delete that account's Threads data at once.
Your whole account: open your profile and choose Delete my account. Its Threads data is deleted at once; the rest after 30 days.
By email: write to support@marotech.my from the address you sign in with.
The waitlist: use the leave the waitlist link in our email. Your address is deleted at once.

Our data deletion page says exactly what is deleted and what stays.

Children

TinyBird is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has signed up, write to us and we will delete the account.

When our support team looks at your workspace

To answer a support request, someone from our team may open a read only view of your workspace, as its owner sees it. Each visit needs a reason, ends by itself after 30 minutes and cannot change anything: no edits, no AI work, no posts, no payments and no settings. We never see your Threads tokens, your password or your two-factor secret. We record who opened the visit, when, why and for how long. The owner gets an email for each visit and sees every visit in Settings, Team. When our team changes your plan or credits, suspends or restores your workspace, records a refund or sends a receipt again, it is recorded with the reason and shown there too.

How we protect your data

Every page is sent over an encrypted connection (HTTPS).
Threads tokens, app secrets and two-factor secrets are encrypted in our database. Passwords are stored only as hashes.
Each workspace's data is kept apart from every other workspace's.
Sign in, sign up and codes are rate limited, and you can turn on two-factor sign in.
Our staff look at customer data only when they need to, to answer a support request or keep the service running.

No system is perfectly secure. If a data breach puts your data at risk, we will tell you and the Personal Data Protection Commissioner as the law requires, and Meta when Threads data is involved. To report a security problem, email security@marotech.my.

Changes to this policy

When we change this policy, we update the date at the top. If a change affects how we use your data in an important way, we email account owners at least 14 days before it takes effect.

Contact

MAROTECH SOLUTIONS, [business address to be added], Malaysia.
Personal data: support@marotech.my
Support: support@marotech.my
Security: security@marotech.my