BAILA LENTO

Privacy Policy

Last updated 31 October 2026

Baila Lento is a marketing service for small businesses. This page says what we collect, why we collect it, who else sees it, and how to get it removed. It is written to be read, not to be skimmed past.

Who we are

Baila Lento is the digital marketing service of SMRIT LABZ PRIVATE LIMITED, a company registered in Bengaluru, Karnataka, India, which operates it. For anything on this page, write to privacy@bailalento.com.

What we collect

When you create an account

Your name, email address and the name of your business. We use these to sign you in and to address the work we produce to the right business.

What you tell us about your business

Your industry, website, brand voice, priorities, competitors and any questionnaire you upload. This is what your marketing is generated from. You control all of it and can change or clear it at any time.

When you connect a social account

If you connect Instagram, a Facebook Page or a Google Business Profile, we receive an access token from that platform along with the account name and its identifier. With the permissions you grant when you connect, we use them to:

• Publish the posts, carousels and videos you have approved to your Facebook Page and Instagram account, and read back whether each one succeeded.
• Read the comments on your posts and the messages people send to your Page or Instagram business account (Instagram Direct and Messenger), so they appear in your Inbox with a suggested reply.
• Send a reply to a comment or message when you press Send, or automatically where you have switched on a keyword reply or simple thank-you replies.
• Read how your posts performed (views, reach, likes, follows) and your follower count, to show your results.
• Read the public profile and public posts of business accounts you name as competitors, through Instagram’s business discovery.

Messages and comments from your customers contain their name or username and what they wrote. We keep them in your workspace only, for your team to answer. We do not read messages on your personal profile, we do not access your contacts or follower lists, and we do not publish a post you have not approved.

Usage information

Which features you use, when requests are made, and errors encountered. This keeps the service working and tells us what to fix.

Google user data (Business Profile and YouTube)

If you connect a Google Business Profile or a YouTube channel, you sign in with Google and choose what to allow. We ask only for what the feature needs: to manage your Business Profile posts and read its reviews (business.manage), and to upload videos you approve to your channel and see its name (youtube.upload, youtube.readonly). We use that access only to do what you asked inside Baila Lento, for your own listing or channel. We do not sell it, use it for advertising, build profiles from it, or let people read it, except where you ask for support, where the law requires it, or to keep the service secure. Baila Lento's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. By connecting YouTube you also agree to be bound by the YouTube Terms of Service, and Google's Privacy Policy applies to what Google holds. You can disconnect in Baila Lento (Integrations) at any time, and you can also remove our access in your Google security settings. When you disconnect, we delete the stored sign-in tokens.

How we protect Google user data

The Google data we handle is limited to: the sign-in tokens Google gives us when you connect, the name and identifier of your Business Profile location or YouTube channel, the reviews on your listing (the reviewer's name, rating and text), and, for YouTube, the title, link and status of the videos Baila Lento uploads for you. This is how we protect it.

• Encryption in transit. Every connection between your browser, our servers and Google is over HTTPS (TLS). We do not accept or send this data over unencrypted connections.
• Encryption at rest. Our database and file storage are encrypted at rest by our hosting provider.
• Tokens are kept apart and unreadable to the browser. Google sign-in tokens are stored in server-side tables, separate from your account and content, that are not readable by the app in your browser or by any signed-in user. Only the server components that post to your listing or channel on your behalf can use them, and a token is used only for the account that granted it.
• Least access. We request only the scopes the feature needs (business.manage for your Business Profile; youtube.upload and youtube.readonly for YouTube). We do not request restricted scopes. Each customer's data is isolated at the database level, so one customer cannot reach another's.
• People. No staff screen displays Google tokens. A small number of named staff can see account details and, for support, a read-only view of your requests (see “Keeping it safe” below). Every such view, and every change to settings that affect your account, is written to an append-only, tamper-evident log that cannot be edited or deleted.
• No other use. We use Google user data only to provide the features you asked for. We do not sell it, share it for advertising, or use it to build profiles. We do not use Google user data to develop, improve or train generalised artificial-intelligence or machine-learning models. Where review text is sent to an AI provider to draft the reply you asked for, it is sent only for that reply, under our agreements with the provider, and is not used by us to train any model.
• Deletion. When you disconnect Google or YouTube in Integrations, we delete the stored tokens at once. When you close your account, we delete your data within 30 days (see “How long we keep it”). You can also ask us to delete any Google user data we hold by emailing privacy@bailalento.com, and you can remove our access at any time in your Google security settings.
• Incidents. If a security incident ever affects Google user data, we will tell the people affected and the relevant authorities without delay, and tell Google as its policies require.

Security and copyright protection

To protect our software, content and your data, we record the IP address, time, browser details and page requested when an automated tool is refused inside the app, and we keep those records for up to 12 months. We do not use your camera or location for this, and we do not identify visitors beyond these technical records.

When you sign in, on the website or in the phone app, we record the time, the kind of device and browser, the IP address and the approximate city and country worked out from that address, together with a random identifier stored on your device. We use this only to keep your account safe: to email you when your account is signed in from a device it has not used before, and to show you under Profile where you are signed in, with a button to sign out other devices. On the website we also ask your browser for your device's location at sign-in; only if you allow it in the browser's prompt do we save that spot with the sign-in, and only you see it, under Profile. Saying no changes nothing. The phone app does not use your location. We keep these records for 12 months.

You can sign in with your email and password, with a one-time code sent to your email, or with your Google or Apple account. If you use Google or Apple, we receive only your name, email address and profile picture from them.

Our public pages (home, pricing, contact and our policies) are open to search engines, AI assistants and other crawlers, so that people can find us. The app, the phone app and your data are not: automated tools are refused there, and nobody may copy the app or its screens.

The Baila Lento phone app

The Android and iPhone apps use the same account and the same data as the website. The app asks for a phone permission only when you use the feature that needs it, and you can refuse or switch it off in your phone’s settings at any time.

• Camera and photos: used only when you choose to take or pick a photo for a post. Only that photo is uploaded, to your business’s workspace. The app does not browse or upload anything else from your phone.
• Microphone and speech recognition: used only while you tap “Speak it”. Your phone’s own speech service (from Apple or Google) turns your words into text; the app receives the text and puts it in the request box. We do not record or keep the audio.
• Face ID and fingerprint: if you switch on the app lock, your phone checks your face or fingerprint itself. We never receive biometric data; the app only learns whether the check passed.
• Notifications: if you allow them, we keep a notification token for your phone so we can tell you about drafts that need you, new leads and posts that went out or failed. Sign out or remove the app to stop them.

The app does not use your location or contacts, does not use advertising identifiers, does not show ads and does not track you across other apps or websites. Your sign-in stays on the phone and is not included in phone backups.

What we never do

• We do not sell your data, and we never will.
• We do not share your business information with other customers.
• We do not use your content to train AI models for anyone else.
• We do not post to your accounts without your explicit approval of that specific piece of work.

Who else is involved

Running the service means a small number of other companies process data on our behalf:

• Supabase: stores your account, your brand settings and your work (Sydney, Australia).
• Railway: hosts the application and our automation (United States).
• OpenAI: generates the draft copy and images from your brief, and sorts incoming comments and messages and drafts replies to them (United States). Your content is not used to train their models under their business terms.
• Groq, Google Gemini and OpenRouter: back-up AI providers for words, used only when OpenAI is unavailable or you choose a fast draft (United States).
• Cloudflare: network protection, DNS and a back-up picture model. It may set a security cookie on the website.
• Resend: delivers the emails we send, such as invites, approvals and new-lead notices (United States).
• Razorpay: takes payments, in rupees in India and in US dollars from businesses abroad (India). Card and UPI details are handled by Razorpay and are not stored in Baila Lento.
• Google Firebase: delivers notifications to the phone app (United States). It receives a notification token and the text of the notification, nothing else.
• Meta and Google: receive the posts you approve, when you approve them, and the replies you send, for the accounts you connect.

Each is bound to use the data only to provide their part of the service. Because some of them are outside India, your data can be processed abroad. The Digital Personal Data Protection Act, 2023 allows this except to countries the Government of India restricts, and we will follow any such restriction. We tell business customers by email at least 15 days before adding or replacing one of these companies.

How long we keep it

• While your account is open: your brand settings and work history, so past approvals continue to improve future drafts.
• Access tokens: until you disconnect the account or the platform expires them, whichever is sooner.
• Comments and messages from your customers: while your account is open, or until you ask us to delete them.
• After you close your account: deleted within 30 days, except records we are required to keep for tax or legal reasons.

Your rights

You can ask us at any time to:

• Show you everything we hold about you.
• Correct anything that is wrong.
• Delete your account and everything in it.
• Export your data in a readable format.
• Disconnect any social account, which also cancels anything queued for it.

Write to privacy@bailalento.com. We reply within 30 days.

Deleting your data

To remove a connected social account, open Integrations in the app and choose Disconnect. The token is deleted immediately and anything queued for that account is cancelled.

To delete your whole account, open More → Delete my account in the phone app, or email privacy@bailalento.com from the address you registered with. Everything is removed within 30 days. How account deletion works.

If you wrote to a business that uses Baila Lento and want your comments or messages removed from our systems, email the same address with the business’s name and your Facebook or Instagram username. We delete them within 30 days.

Cookies and browser storage

We use only the browser storage the app needs to keep you signed in and to remember choices such as which screen you were on. We do not use advertising cookies or sell data to advertisers.

Keeping it safe

Access tokens are stored separately from everything else, encrypted at rest, and cannot be read by the application in your browser — only by the server components that publish on your behalf. Every customer’s data is isolated at the database level, so one customer cannot reach another’s.

Our own staff. To give you support and to keep the service safe, the owner of the Baila Lento platform can open a read-only view of a customer’s requests: the title, the brief as written, the caption and picture that were made, and what was scheduled or posted. That view does not include your inbox messages or your leads, and it cannot change anything. Only the platform owner role can open it, and each time it is opened the date, the person and the workspace are written to our tamper-evident log. Other staff see account details, billing, support tickets and usage figures, not the content of your requests.

No system is perfect. If a breach ever affects your data, we will tell you and the relevant authority without delay.

Your rights and our grievance contact

Under the Digital Personal Data Protection Act, 2023 you may withdraw a consent you gave us, ask for information about what we hold, ask us to correct or erase it, name another person to exercise these rights for you if you die or cannot, and complain. Write to the Grievance Officer, SMRIT LABZ PRIVATE LIMITED, atprivacy@bailalento.com. We reply within 30 days. If you are not satisfied you may complain to the Data Protection Board of India.

If you are a customer of a business that uses Baila Lento, that business decides how your details are used and we process them for it. We pass your request to them, or answer it if you write to the address above.

If you are outside India

Businesses in the United States, Canada, Australia, Singapore, the United Arab Emirates and elsewhere can use Baila Lento. Your data is stored in Australia and processed in the United States and India by the companies listed above.

• United States (including California): for the people who contact a business through Baila Lento, we act as that business’s service provider. We do not sell or share personal information for cross-context behavioural advertising, and we use it only to provide the service. You can ask what we hold, to correct it or to delete it, by writing to the address above; we will not treat you differently for asking.
• Canada, Australia and Singapore: you can ask for access to and correction of your personal information, and complain to us first; you may also complain to your own privacy regulator (the Office of the Privacy Commissioner of Canada, the OAIC in Australia, or the PDPC in Singapore). If a data breach is likely to cause you significant harm, we tell you and the business you dealt with without undue delay.
• Marketing messages: review requests and other messages sent through Baila Lento are sent for the business that uses it. Every such email carries a way to stop them, and we honour it within five working days.
• Pictures made with AI carry a marking in the image data saying so. We do not remove it.

Children

Baila Lento is for businesses. It is not intended for anyone under 18.

Changes

If we change this policy in a way that matters, we will email you before it takes effect. The date at the top always shows the current version.