Privacy Policy

Last updated 7 November 2026

This policy explains what IDLE Marketing Solutions (“the Service”), operated by Zach Idlett, doing business as IDLE Marketing Solutions, collects from the food-truck businesses that use it, why, and what we do with it.

The Service exists to do one thing: read a business’s calendar, draft a social post for each upcoming stop, and — with that business’s permission — publish it to their own Facebook Page and Instagram account. Everything below follows from that.

Who this policy covers

Our customers are businesses. We do not offer the Service to consumers, and we do not knowingly collect information from anyone under 18. The people whose information we hold are the owners and staff who create an account.

What we collect

Account information: Your business name, login email address, and a hashed version of your password. We never store your password itself and cannot recover it.
Brand profile: The details you enter to shape generated posts: tone of voice, standard hashtags, sample captions, business description, brand colours, and an optional logo image.
Google Calendar data: If you connect Google Calendar, we read events from the calendar you select in order to find your upcoming stops. From each event we store the event identifier, title, location text, and start and end times. We request read-only access (calendar.readonly) and cannot create, edit, or delete anything in your calendar.
Meta account connection: If you connect Facebook and Instagram, we store the identifiers of the Page and Instagram Business account you choose, and an access token that lets us publish on your behalf.
Generated content: The captions and images the Service produces for your stops, along with their status and publication timestamps.
Billing information: If you subscribe, we store your Stripe customer identifier, your subscription status, and when your current billing period ends. Card details are handled entirely by Stripe and never reach our systems.
Basic account activity: Account creation, last login, and approval or suspension timestamps. Server logs record errors and requests for operational purposes, including the IP address a request came from. We also hold IP addresses briefly in memory to rate-limit sign-in and sign-up attempts, which is how we stop password guessing; those counters expire on their own within minutes.

We do not use tracking cookies or third-party analytics. The only cookie the Service sets is the one that keeps you signed in, which expires after 14 days.

How we use it

To sync your stops from your calendar and generate a draft post for each one.
To publish posts you have approved, or that you have configured to publish automatically.
To operate, secure, debug, and support the Service.
To contact you about your account.

We do not sell your information, share it with data brokers, use it for advertising, or use it to build profiles across other services.

Limited Use of Google user data

The Service’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Specifically, calendar data obtained through Google APIs is:

used only to provide and improve the stop-syncing and post-generation features you signed up for;
never transferred to others except as needed to provide those features, for security purposes, or to comply with applicable law;
never used for advertising; and
never read by a human, except where you have given explicit permission for specific messages, where it is necessary for security or to comply with applicable law, or where the data has been aggregated and anonymised.

Calendar event text is sent to our AI providers solely to draft the caption for the corresponding stop. See Service providers below.

Service providers

The Service depends on a small number of processors. Each receives only what it needs to do its job:

Anthropic: Receives your brand profile and the details of an upcoming stop in order to draft a caption.
OpenAI: Receives an image prompt derived from your brand profile and stop details in order to generate the post image.
Google: Provides the Calendar API we read your stops from and the geocoding service we use to resolve a stop’s location text.
Meta: Receives the caption and the image URL when a post is published to your Facebook Page or Instagram account. Meta fetches the image directly from our storage.
Stripe: Processes subscription payments. You enter your card details on Stripe’s own hosted checkout page — we never see or store your card number. We store the Stripe customer identifier, your subscription status, and the date your current billing period ends.
Resend: Delivers transactional email on our behalf, such as your address verification message. Receives your email address and the contents of that message.

Generated images are stored in object storage and served from a public URL. This is a technical requirement: Meta publishes an image by fetching its URL from Meta’s own servers, so image URLs are not secret. Do not put anything confidential into a generated image.

How we protect it

Google and Meta access tokens are encrypted at rest.
Passwords are stored only as salted hashes.
Session cookies are signed, and marked Secure in production.
The databases are not exposed to the public internet.

No system is perfectly secure, and we cannot guarantee absolute security.

How long we keep it

We keep your account data for as long as your account is open. Stops and posts are retained as part of your account history. When you delete your account we remove your data as described on our data deletion page.

Disconnecting Google or Meta deletes the stored tokens for that connection immediately. Posts already published to Facebook or Instagram remain on those platforms; you control them there.

Your rights

Depending on where you are, you may have the right to access, correct, export, or delete your information, and to object to or restrict certain processing. To exercise any of these, contact us at zach@idlems.tech. We will respond within 30 days.

International transfers

The Service and its providers may process information in the United States and other countries. Where required, we rely on appropriate safeguards for those transfers.

Changes

We will update the date at the top of this page when this policy changes, and will notify account holders by email of material changes before they take effect.

Contact

Zach Idlett, doing business as IDLE Marketing Solutions
(not yet provided)
zach@idlems.tech