Privacy
Privacy policy
Studio by BobWork (“Studio”) is made by BobOffice LLC, a Delaware company. This page says what we collect when you use studio.bobwork.ai, what we do with it, who else touches it, how long we keep it, and how to make us delete it. It is written to be read, not skimmed past.
Effective 26 October 2026 · BobOffice LLC · info@bobwork.ai
1. Who we are
BobOffice LLC, Delaware, United States, operates Studio. You can reach the people responsible for your data at info@bobwork.ai. We answer within one working day.
2. What we collect, and why
| Data | Where it comes from | Why we need it |
|---|---|---|
| Your name and email address | Google sign-in, or the address you type to receive a sign-in code | To sign you in, tell you what the studio did, and reply to you |
| Your brand: name, website, logo, what it stands for, the daily plan | What you type in onboarding, and what we read from your public website | To make content that argues your message and nobody else’s |
| Content the studio makes for you, and files you upload | Generated by us, or uploaded by you to the media bank | So you can review, schedule, download and publish it |
| Connected-channel tokens (Facebook, Instagram, TikTok, LinkedIn) | Granted by you when you connect a channel | To publish approved pieces and read their results. Never for anything else |
| Usage records: what was generated, what it cost in credits, what was approved | Produced by the product as you use it | To meter your plan, show you the bill before it happens, and never charge a failed render |
| Answers to the onboarding questions (team size, role, business type, goals, source) | What you pick in onboarding | To shape what we suggest first. None of it gates the product |
| Billing details | Stripe, when you pay | To charge the plan you chose. We never see or store card numbers |
| Server logs (IP address, browser, pages requested, errors) | Your browser, automatically | To keep the service up and to stop abuse. Kept 30 days |
We do not use advertising trackers, we do not sell data, and we do not train models on your content. The only cookies are the ones that keep you signed in and remember which brand you were looking at.
3. Who processes it for us
Studio runs on a small set of services. Each sees only what it needs to do its job.
- Vercel (United States) — hosting, and file storage for generated content and uploads (Vercel Blob).
- Supabase (United States) — the Postgres database everything above lives in.
- OpenAI (United States) — generates images and copy from your brand message. Prompts contain your brand message and, for a UGC photo, your influencer’s reference images; they never contain your customers’ data. OpenAI does not train on API traffic.
- Resend (United States / EU) — sends sign-in codes, invites and support replies.
- Stripe (United States) — takes payment and stores card details on our behalf.
- Google — sign-in, if you choose it. We receive your name, email and profile picture; nothing else.
- Meta, TikTok, LinkedIn — the platforms you connect. Publishing sends them the approved piece and its caption; reading results asks them for the numbers on that post.
4. How long we keep it
- Your brands and content — until you delete them, or delete the workspace.
- Connected-channel tokens — until you disconnect the channel (Channels page) or delete the workspace. Disconnecting revokes our access at once.
- Usage and billing records — for the life of the workspace, then 7 years for the parts tax law makes us keep.
- Backups — the database is backed up continuously; deleted data leaves backups within 30 days on their normal rotation.
- Server logs — 30 days.
- Support messages — 24 months, so we can see what we told you.
5. Deleting your data
You can do it yourself: Settings › Danger zone › Delete this workspace removes your brands, content, schedules, connected-channel tokens, uploads and usage records, and deletes the files from storage at the same time. Delete a single brand from Settings › Brands. The step-by-step is on the data deletion page. If you would rather we do it, email info@bobwork.ai from the address on the account and we will confirm when it is done.
6. Your rights
Wherever you are, you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, or object to how we use it. People in the EU, UK, Switzerland, California and similar jurisdictions have these rights in law; we extend them to everyone. Write to info@bobwork.ai. We do not discriminate against anyone for exercising them.
7. Security
Data is encrypted in transit and at rest with the providers above. Sign-in uses Google or one-time codes; we hold no passwords. Every query in the product is scoped to your workspace by design, and an audit log records who approved, scheduled or deleted what. If we ever learn of a breach affecting your data we will tell you within 72 hours of confirming it.
8. Requests from public authorities
If a court, government agency or other public authority asks us for your data, including data we receive from Meta, TikTok or LinkedIn when you connect a channel:
- We check that it is lawful. We review every request for a valid legal basis and proper scope before acting on it.
- We push back on unlawful requests. If a request is unlawful, too broad or unclear, we challenge it, and use the legal remedies available to us.
- We give the minimum. When we must comply, we disclose only the data the request strictly requires.
- We keep a record. We document each request, how we answered it, the legal reasoning and who was involved.
Unless the law forbids it, we tell you before we disclose anything about your account. We have not received any such request to date.
9. Children
Studio is for businesses. It is not directed at anyone under 16, and we do not knowingly collect their data.
10. Changes
When this page changes in a way that matters, we email account owners before it takes effect and update the date at the top. Earlier versions are available on request.