baymonk

Privacy Policy

Última actualización: October 29, 2026

Esta política también está disponible en español.

Baymonk is a platform operated by WIPERNET, LLC (Wiper Agency) that agency teams use to monitor the community, content and paid media — their own and their competitors' — of the brands they manage. This policy explains what data Baymonk processes, where it comes from and who it is shared with.

1. Who processes the data

WIPERNET, LLC is the data controller for the data Baymonk processes. Its address is 7900 Oak Lane Suite 400, Miami, FL 33016, United States. For any question about this policy, or to exercise the rights described in section 6, write to braian.greno@wiperagency.com.

2. What data we collect

From people who use Baymonk (agency teams): name, email, password (stored hashed, never in plain text), and role within their team.

From the social media accounts being monitored — the client's own and its competitors' —: account name, follower count, and the content they publish (text, format, date, public engagement metrics).

From people who comment on those posts. People who comment on a post of a brand monitored in Baymonk are not users of the platform and never registered anywhere. For those comments we process the text, the publicly visible name or handle, the like count, and an AI-inferred sentiment (Positive, Neutral or Negative) for that specific comment. This processing is based on our client's legitimate interest in managing its community and on the fact that the information was published publicly by the person themselves. We do not use this data to profile those people outside that context, nor do we cross-reference it with other sources.

Credentials for third-party services. When someone connects a Google or Meta account to Baymonk, we store the access token those platforms issue — encrypted at rest with AES-256-GCM, never in plain text — so we can read (and, only if explicitly authorized, moderate) the connected accounts.

Advertising data: spend, impressions and reach of the ad accounts the client connects.

AI questions and analysis context. To generate AI responses and analyses, Baymonk processes the team's questions, the selected client's context and the data included in the analysis or returned by authorized reading tools. Depending on the feature, this can include posts, social or advertising metrics and results from the client's connected integrations. The AI provider is determined by the configuration of that analysis and is identified in section 3.

3. Who we share data with

We do not sell data to anyone. We share it only with the providers that make the service work, under their own confidentiality terms:

For Anthropic's commercial API, data is stored in the United States. Processing by Anthropic and its subprocessors may have global reach, depending on the service and routing settings. Its public subprocessor list includes worldwide processing locations. See Anthropic's data processing terms, commercial API locations, subprocessor list and geographic controls.

4. Google user data

Baymonk lets users optionally connect a Google account through Google's OAuth flow. Connections for analytics are read-only. The optional YouTube publisher requests separate upload permission and only reaches the data the person authorizes on Google's consent screen. These are the permissions (scopes) Baymonk requests, the data each one accesses, and the user-facing feature it powers:

What we do — and do not do — with that data. Data obtained from Google APIs is used exclusively for the features described above: displaying it in the dashboards of the team that connected the account, and including it in the reports that team generates, and uploading the content you expressly authorize to your selected YouTube channel. We do not use it for advertising, we do not sell it, we do not use it to determine creditworthiness or for lending purposes, and we do not use it to train generalized artificial intelligence models. When an AI-generated report includes metrics that came from Google, only the data needed to write that user-requested report is sent to the AI provider configured for that analysis, among the providers identified in section 3. The publishing workflow itself does not send your Google account data to an AI provider. No one at WIPERNET, LLC accesses Google user data except with the client's consent for support, for security purposes (investigating abuse or an incident), or to comply with applicable law.

How we protect that data. All communication — between your browser and Baymonk, and between Baymonk and Google's APIs — is encrypted in transit over HTTPS/TLS. Google refresh tokens are encrypted at rest with AES-256-GCM; the encryption key lives only on the production server, outside the database and the source code. Access tokens are short-lived (1 hour). Analytics access tokens exist only in server memory; publisher access tokens and resumable upload session URLs are stored encrypted to recover interrupted uploads. The publisher can create a video only after your explicit consent. Access within the platform is limited by team and by role: data from a connected account is only visible to members of the team that connected it. Each connection records its last use and its errors so anomalous access can be detected.

Revocation and deletion. You can disconnect your Google account from Baymonk's settings. Publisher accounts can be disconnected in the publisher; stored publisher credentials are removed when the last destination using that authorization is disconnected. This does not delete previously uploaded videos. You can also revoke access from your Google Account permissions. Derived data (metrics already incorporated into historical reports) is deleted on request within 30 days at most, following the process on the data deletion page.

Baymonk's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Meta and YouTube publishing

The optional publisher stores the media you upload, editable text, selected destination, publishing options, consent timestamp and submission history. Meta permissions pages_show_list and pages_read_engagement list the pages you authorize; pages_manage_posts publishes to your selected Facebook Page. instagram_basic and instagram_content_publish identify and publish to your selected professional Instagram account linked to an authorized Page. Meta downloads your media through signed links that expire after 24 hours. YouTube receives your selected video through its resumable upload service. Publishing credentials are encrypted at rest and used only on the server. Publisher content and platform data are not used to train AI models.

Disconnecting a destination removes its local link. If no destination uses that publisher authorization, its stored credentials are deleted. You can revoke the app in your platform account settings. Submission history and uploaded files follow the retention and deletion process below. YouTube API use is also subject to the YouTube Terms of Service and the Google Privacy Policy.

TikTok account connection and publishing

Customers may connect their own TikTok accounts through TikTok's authorization screen. With user.info.basic, Baymonk reads the account identifier, display name and avatar to identify the selected destination. With video.publish or video.upload, Baymonk sends the media you select and the options you explicitly confirm, either for direct publication or to continue editing in TikTok. With video.list, Baymonk reads your public videos and their views, likes, comments and shares to display results in the publisher.

TikTok access and refresh tokens are encrypted at rest and used only on the server. Baymonk stores your uploaded media, copy, consent and submission history to provide the publishing workflow. Media is made available to TikTok through signed links that expire after 24 hours. Disconnecting the account revokes access and removes its stored credentials; submission history and uploaded files remain subject to the retention and deletion process below. You can also revoke access in TikTok's account settings. TikTok data from this publisher is not used to train AI models.

5. How long we keep data

Baymonk accumulates history by design: for example, an ad from the public ad library that a competitor takes down is not deleted — it is marked inactive to preserve the archive. We keep the data while the client has a contracted service, and delete it on request — see the data deletion page — or when the relationship with the agency ends.

6. Your rights

You can request access to, rectification or deletion of your data, and object to its processing, by writing to braian.greno@wiperagency.com. If you are a person who commented on a post of a Baymonk client (not a registered user), the same channel applies.

7. Cookies

Baymonk uses technical cookies to keep the session signed in and protect account authorization flows. The TikTok connection uses an httpOnly cookie that expires after 10 minutes to verify the authorization request. These cookies are not used for advertising or cross-site tracking. We do not use analytics cookies or third-party tracking cookies.

8. Changes to this policy

If we update this policy, we will change the "last updated" date at the top of this page. Substantial changes will be announced by email to registered users.

9. Text messages (SMS)

Some businesses that use Baymonk run loyalty or referral programs. A customer joins in person, by scanning the program's QR code, and enters their name, email and phone number on a page that states they agree to receive text messages (SMS) from that business about their benefits and redemptions. We use that phone number only to send those messages, through our SMS provider (Twilio). Messages are transactional: confirmation of a redeemed benefit, points earned and reminders about benefits the customer signed up for. Message frequency varies; message and data rates may apply.

Phone numbers and SMS opt-in consent are never shared with or sold to third parties for marketing or promotional purposes. You can stop receiving messages at any time by replying STOP, get help by replying HELP, or write to braian.greno@wiperagency.com.