Trust and safety
Rules we wrote before the first line of code
An AI that posts on your behalf needs clearer boundaries than a human assistant. These are ours, in plain language, and they are part of the product, not a policy page.
You approve, we publish
Nothing goes live without your tap. Autopilot exists, but you switch it on per format, and you can switch it off in one tap from any notification.
AI content is labelled
Any video edited or generated by AI carries a visible label and platform metadata, in line with Article 50 of the EU AI Act. Real photos with motion and text are still marked as AI-edited. We do not hide it.
Official APIs only
We connect through Meta, Google and TikTok developer programmes, with the permissions they review. We never ask for your password and never run a bot on your account.
Your data, your model
Your photos and results train the model of your business only. Anonymised performance patterns improve the planner for everyone; your images never appear in anyone else's video.
No fake people, no fake claims
The reviewer blocks invented reviews, invented awards, health claims and prices that don't match your menu. Creative mode cannot generate people.
Stored in the EU, deleted on request
Data lives in EU data centres. Disconnect your accounts and we delete your media within 30 days; export is one button away before that.
Compliance
What the law asks, and what we do about it
| Requirement | In Oxlume |
|---|---|
| EU AI Act, Art. 50: disclose AI-generated content | Visible label plus platform metadata on every AI-edited post, on by default, cannot be disabled |
| GDPR: lawful basis, access, deletion | Contract as basis, export and delete from the app, EU hosting, DPA for business customers |
| Platform terms (Meta, TikTok, Google) | Official APIs, reviewed permissions, rate limits respected, no automation outside the APIs |
| Image rights of people in your photos | Consent checkbox per photo with faces; the reviewer flags unconsented faces |
We are a beta-stage company. Our legal texts are reviewed by counsel before commercial launch; until then they are marked as drafts.
Security
Boring on purpose
- OAuth tokens encrypted at rest, scoped to publishing only, revocable from the app
- Media stored encrypted, access logged, no employee access without a ticket
- Model calls run without retention at the provider, under enterprise terms
- Independent penetration test before public launch; summary published here
- Report a vulnerability: security@oxlume.com
Ask us anything
If something here is unclear, write to the founder directly. Trust questions get answered first.
Contact