byline.fyi Privacy Notice
Effective date: 8 July 2026
Last updated: 19 October 2026
This privacy notice explains how byline.fyi handles personal data.
Who operates byline.fyi
PodApp LTD operates byline.fyi. For the UK GDPR and the Data Protection Act 2018, PodApp LTD is the controller of personal data it processes for its own purposes, including accounts, security, billing, and product analytics. When you use byline for a business and submit personal data about other people, you are the controller of that data, or a processor acting for your own client. PodApp LTD is then your processor, or your subprocessor if you are a processor. Those roles follow the processing activity, not a single role for the company.
- Legal name: PodApp LTD
- Legal form: Private limited company, registered in England and Wales
- Company number: 13613926
- Country: United Kingdom
- Registered office: 86-90 Paul Street, London, England, United Kingdom, EC2A 4NE
Questions or privacy requests: dylan@byline.fyi.
Studio and other business users can request a data processing agreement from that address. The Terms of Service describe that arrangement.
Why we use personal data
PodApp LTD relies on these UK GDPR lawful bases:
- Contract. To create your account, run your workspace, and provide the features you pay for.
- Legitimate interests. To keep the service secure, prevent abuse, understand
how the product is used, measure advertising conversions, and run the business,
where those interests are not overridden by your rights. This basis covers the
always-on attribution cookie (
byline_attr), the DataFast visitor cookie when DataFast is enabled, the server-side Meta and DataFast events that run regardless of your browser cookie choices, and PostHog page views sent from memory before a consent choice. You can object to that processing. - Consent. For optional analytics and advertising tags that ask for your choice, including the persistent PostHog analytics cookie, and for any other processing we do only with your consent. You can withdraw consent at any time. Those choices do not gate the always-on attribution and conversion processing above.
- Legal obligation. For records we must keep for tax, accounting, and similar legal duties.
What byline does
byline reads content you connect or forward, builds a creator profile and memory for your workspace, and makes that memory available to the AI tools you choose to connect. Your workspace data is scoped to your workspace.
Data we collect
Account and workspace data
- Name, email address, sign-in status, sessions, and optional Google sign-in identifiers.
- Workspace name, members, roles, invitations, onboarding state, subscription status, plan limits, and audit events.
Content and source data
- Published work from connected sources such as websites, Instagram, and YouTube.
- Private notes or drafts you add or forward by email.
- Audience comments and engagement metrics where a connected platform exposes them.
- Derived data generated to provide the service, including summaries, chunks, transcripts, embeddings, memories, profile facets, and insights.
- Source credentials, such as platform access tokens, stored so byline can sync the sources you connect.
Billing data
Stripe handles payment details. byline stores Stripe customer, subscription, plan, and invoice identifiers needed to run billing and entitlements. byline does not store full card numbers.
Logs, security, and usage data
byline keeps operational logs, audit events, rate-limit counters, COGS counters, request metadata, and similar records needed to run, secure, and debug the service.
Advertising, analytics, cookies, and Meta
byline uses strictly necessary cookies for sign-in, security, and normal product operation.
byline sets first-party analytics and advertising cookies when you visit. byline's
own attribution cookie (byline_attr) and, when DataFast is enabled, the DataFast
visitor cookie (datafast_visitor_id) are set directly by the site on load, so
they are not gated by the tag manager. When the operator loads Google Tag Manager
and configures consent management there (Google Tag Manager Consent Mode), the
choices you make in those controls govern the additional analytics and advertising
tags the tag manager itself fires.
When PostHog is configured, the site also loads PostHog's browser SDK from the EU cloud. PostHog starts without a persistent analytics cookie. It may send page views from memory before a consent choice. Those page views omit invitation links, search text, and URL fragments, and that pre-consent processing uses legitimate interests. A persistent PostHog cookie is written only after tag-manager consent grants analytics storage, and that cookie uses consent. PostHog does not record session replay.
Separately, when configured by the operator, byline sends server-side conversion
events to Meta's Conversions API and payment events to DataFast. These server-side
events do not set browser cookies and they still run regardless of your browser
cookie choices. The always-on byline_attr cookie, the DataFast visitor cookie,
and these server-side events use legitimate interests, not consent. You can
object to them. The events may include:
- for Meta events, a hashed email address, hashed name, and hashed byline user id;
- for DataFast events, the visitor id plus a plain email address, name, and account identifiers;
- Meta click identifiers such as
_fbpand_fbc, if present; - IP address and user-agent for the Meta sign-up event only;
- payment value and currency for
Purchaseand DataFast payment events.
Paid Subscribe and Purchase events do not replay stored sign-up IP address or
user-agent.
byline also runs a daily retention sweep that nulls stored sign-up IP address and
user-agent after roughly 180 days while keeping non-PII click and campaign ids.
Meta receives this data for advertising conversion measurement and may process it under its own business tools terms. This is a real external processing path, not a browser-only pixel.
Who receives data
byline uses a small set of service providers:
| Provider | Purpose | Data shared |
|---|---|---|
| OpenRouter | Routing, privacy controls, and usage accounting for DeepSeek text and image processing | Content, notes, comments, images, and derived prompts needed for the requested processing |
| DeepInfra | DeepSeek V4.1 Flash model inference through OpenRouter's zero-data-retention route | Content, notes, comments, images, and derived prompts needed for the requested processing |
| Google AI Studio / Gemini | Video understanding and embeddings | Video URLs or uploaded media, text content, and derived text needed for embeddings or analysis |
| Google Sign-in | Optional sign-in | Google account identifier and basic profile if you choose Google sign-in |
| Google Tag Manager | Optional browser analytics | Browser analytics and tag data, subject to your consent choices in the tag manager, and only when configured |
| PostHog (EU) | Product analytics | Page views without invitation links, search text, or URL fragments, and after sign-in the account id, email, referrer domain, campaign parameters, and product events. Hosted in the EU. No session replay. A persistent cookie waits for tag-manager analytics consent |
| DataFast | Product analytics and revenue measurement | Anonymous visitor id, payment amount and currency, and account identifiers such as email needed to measure conversions and subscriptions |
| Meta Platforms, Conversions API | Server-side advertising conversion measurement | Hashed account identifiers, click ids, and the sign-up IP address and user-agent described above |
| Meta Platforms, Instagram Graph API | Instagram source connector | Instagram content, comments, metrics, and API requests you authorize |
| Cloudflare Email Service | Transactional and inbound email (Email Sending and Email Routing) | Sign-in emails, support emails, and forwarded inbound messages |
| Stripe | Payments and subscriptions | Billing identifiers, payment metadata, and subscription state |
| Cloudflare | DNS, secure ingress, and edge delivery | Request metadata such as IP address and user-agent |
| Hetzner Object Storage | Disaster-recovery database backups | Backup copies of application data, retained under the infrastructure backup policy |
The application and primary Postgres database run on operator-managed infrastructure. The infrastructure repository owns the current backup configuration; this notice names Hetzner because database backups are an external processing path even though the live database is self-hosted.
International transfers
Some providers process personal data outside the United Kingdom. Where that happens, PodApp LTD uses the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or a UK adequacy regulation.
Cloudflare, Stripe, and OpenRouter are in the United States. Transfers to them use the IDTA or the UK Addendum. PostHog is hosted in the European Union, and transfers there rely on the UK adequacy regulations for the European Economic Area. The same approach covers the other providers in the table when they process personal data outside the United Kingdom. DataFast's data processing agreement says most of its infrastructure is outside the European Economic Area, including in the United States, and that those transfers rely on its subprocessors' safeguards, including Standard Contractual Clauses.
AI providers
Content is sent to AI providers only to provide the product features you request.
Retention
- Workspace content and derived data are kept while the workspace exists, unless you delete the content or remove the source.
- Disconnecting a source deletes that source's stored content and audience data.
- Billing records are kept as needed for accounting, tax, fraud, and dispute handling.
- Audit logs are retained for security and accountability and may outlive the workspace or user they refer to.
- Disaster-recovery database backups are retained for about 30 days.
- Advertising attribution IP address and user-agent are nulled after roughly 180 days. Click ids and campaign parameters are kept with the user account unless the account is deleted.
Your choices and rights
The first-party byline_attr attribution cookie and, when DataFast is enabled,
the DataFast visitor cookie are set on load and are not governed by the tag
manager's consent controls; you can block or clear them through your browser
settings. A persistent PostHog analytics cookie is written only after the tag
manager grants analytics storage. The tag manager's consent controls govern only
the additional analytics and advertising tags the tag manager itself fires. You
can disconnect sources or delete individual content inside the product.
Under the UK GDPR you can ask PodApp LTD to:
- give you access to the personal data we hold about you;
- correct inaccurate personal data;
- delete personal data;
- restrict how we use it;
- provide a portable copy;
- object to processing based on legitimate interests, including the always-on attribution and conversion measurement described above;
- honour a withdrawal of consent, where consent is the lawful basis.
Email dylan@byline.fyi. We may need to confirm it is you before we act. You can also complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk/make-a-complaint or by post to the ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Security
byline uses workspace scoping, signed webhooks, rate limits, COGS controls, central log redaction, and audit logging. No internet service is risk-free. Report suspected security issues to dylan@byline.fyi.
Changes
We may update this notice as the product changes. The live version at /privacy
is the current public notice. The date at the top shows when it was last updated.