Privacy policy

Laras (https://laras.my) is a service run by Aidan Partners. It takes the photos and short videos a business sends in, together with the caption it writes for each one, and posts them to that business's own social accounts with its permission. This policy says what we keep, why, who else sees it, and how to have it deleted.

Last updated: 16 October 2026.

Who we are

• Aidan Partners (Registration No. 202603095602), Level 30, Menara Prestige, Jalan Pinang, 50450 Kuala Lumpur, Federal Territory of Kuala Lumpur.
• Questions, or a request about your data: aidanpartners23@gmail.com.

What we keep, and why

From a business that uses the service

• The business's name, time zone and settings, so we know what to post and when.
• The photos and videos it sends us, the note that comes with each one, and the captions it writes for them. We need these to make the posts, and to show what went out.
• The posts themselves: what was published, where, and when.
• Who approved, edited or rejected each post, and at what time. This is how we can show a post was agreed to.
• Alerts about anything that was held or failed.

From the people who sign in

• Name and email address to identify your account and its brand access. You can sign in with Google or an email sign-in link. Google sign-in supplies basic identity information; it does not itself give Laras access to Gmail or Calendar. Email links are temporary and single-use; their stored verification value is a one-way hash.

From the social accounts a business connects

• The access tokens those platforms give us, so we can post to the accounts the business chose. They are stored encrypted, we never see or store the password to any platform account, and a business can disconnect at any time on its Platforms page.
• How each post is doing on Facebook, Instagram and Threads: the number of likes, comments and shares, read every few hours for a month after it goes out, so the business can see it on its dashboard. We ask for the totals and nothing else — who liked a post and what anybody wrote under it never reach us.
• How many people saw each post, where the platform will tell us. This is a count of people, not a list of them: we are given one number and never who they were.
• How many times each Facebook post was clicked, as Facebook itself counts it. One number for the post: never who clicked, and never where a click led.
• If a business has an advertising account on Meta and has let us read it: what its advertising did over the last few weeks — the amount spent and in which currency, how many times the adverts were shown, how many people saw them, and how many clicks they got. Read only, never changed, and never used for anything but that business's own page. We never create, pay for or stop an advert.

Automatically

• Ordinary server logs: what was done, when, and whether it worked. They never contain a caption's media, a password, a token or an API key.
• When somebody follows a link a business put in one of its own posts, and that business has asked for its links to be counted, we add one to that post's number and note the time. They go exactly where the business pointed them, and that address comes from our own record rather than from anything in the request. One number and one time is the whole of what we take: no address, no browser, no country, no row per visit, nothing that could say who followed it and nothing that could be joined up afterwards — somebody who clicks a link in a public post has no account here and has agreed to nothing, so the only thing we learn from them is that it happened. Nothing is ever added to a caption for this. A business whose links are not counted, and any caption with no link in it, goes out untouched and nothing passes through us at all.

Location data in photos and videos

Photos and videos from a phone usually carry the place they were taken, the model of the phone and the moment it was recorded. Every social-post copy we publish has that information removed first. This describes the publishing flow; files or screen content you separately ask Jarvis to analyze are covered below.

What you sent us stays as it arrived, that information included, until it is deleted on the schedule below. It is your photo: it comes back to you whole when you download your data, and it is held by the storage providers described below.

Who else sees it

We send only what is needed to do the job, and only to:

• The social platforms a business has connected (Facebook, Instagram, Threads, TikTok, X), which receive the post and its media — that is the point of the service.
• Railway, which hosts the Laras server and server-side records. Desktop-only records remain on your computer.
• Supabase, which stores the photos and videos you send us.
• Resend, which delivers email sign-in links and receives the recipient address and email content.
• Google, for Google sign-in and, only when separately connected, Gmail and Calendar operations described below.
• Google Gemini, for enabled Jarvis AI features. Depending on the feature you request, this can include your command, relevant conversation/context, document sections and question, screen content you choose to analyze, or a research query. Gemini can generate explanations and conversational replies. These are separate from the social publishing workflow, where the business supplies its captions.
• Tavily, when you request web research and this search provider is enabled. Tavily receives the search question to find public web sources. The returned source excerpts, your question and relevant research conversation are sent to Gemini to prepare a cited summary. Laras does not automatically attach your local files, Gmail messages or calendar events to these searches.
• Groq, for enabled cloud speech recognition. Short recorded command audio passes through the Laras server to Groq to produce a transcript. While Nadi, the Laras companion on your computer, is listening for "Hey Nadi", a phrase of about a second that might be those words is also sent through the Laras server to Groq to check: only whether it was "Hey Nadi" comes back to your computer, and the words are neither kept nor logged. Longer speech near the computer is not sent while Nadi waits. This differs from browser speech recognition.
• Your browser or operating system speech services, when you use their speech features. Their processing depends on your device and browser settings. Jarvis can also retain conversation history locally on your computer.

Every caption is written by the business itself; nothing here generates one for you. We do not sell anything to anybody, we do not use any of it for advertising, and we do not use a business's photos or captions to train anything.

Jarvis and questions you ask

Jarvis can use your commands and relevant context to understand requests and generate responses. Cloud-powered features transmit the data needed for that feature to the providers listed above. Avoid including unrelated private information in a command, document or screen you choose to share. Local file access and cloud analysis are different operations: asking for an explanation of a document can send the supplied document sections to the configured AI service.

Desktop conversation history can remain on your computer. The command “clear my conversation” clears the conversational memory handled by that feature; it does not delete every task record, exported file or server record. Some web questions appear in page addresses and therefore may remain in browser history and hosting logs.

Connected Google email and calendar

Connecting Gmail or Calendar is optional and separate from Google sign-in. You choose whether to allow reading email, reading calendar events, sending email, or changing events. Laras identifies the connected Google account by its account identity and email address. Access is associated with your Laras account and brand.

With email-reading permission, Laras can search your mailbox and retrieve a message you select. With calendar-reading permission, it can list events within a requested date range; the current tool uses your primary calendar. Requests pass through the Laras server to Google and the results are displayed in connected tools. Reading does not grant sending or editing permission.

If you separately enable sending or event changes, Laras shows a preview for confirmation before carrying out the exact action. Preview details and operation results are stored encrypted to support confirmation and tracking. Access and refresh tokens are also stored encrypted. Laras does not ask for your Google password.

Disconnecting in connected tools disables that connection and clears its stored access and refresh tokens. It does not erase connection metadata or historical operation records. You can also remove access through your Google Account's third-party connections settings.

Google-connected operation records and connection metadata currently have no automatic expiry in the integration store. To request their deletion or a copy, contact aidanpartners23@gmail.com and identify the connected account and Laras brand. The business export does not automatically include all connected-tool records or desktop history. Disconnect first if you want access stopped immediately; a deletion request is a separate process.

Laras uses Google API data to provide the user-requested connected features, not for advertising or to train a general-purpose AI model. Laras's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Where it is kept

Your photos and videos are stored in Singapore.

The main service records are hosted on the Laras server. Cloud providers may process information outside your country or the main hosting region; desktop records are also stored on your own computer.

How long we keep it

• Original photos and videos: 90 days after a post is finished, then deleted automatically.
• Posts, captions and the record of who approved what: while the business uses the service.
• Server logs: 90 days.
• Backups: the newest 30 daily copies, so a deleted item can persist in a backup for up to 30 days before it ages out.

How to have your data deleted

Whenever you like, at no cost:

• Ask us: email aidanpartners23@gmail.com from the address you sign in with, and say which business it is.
• Or ask whoever set your business up here to delete it for you.

We delete the business's photos and videos, its posts, its captions, the record of what was decided, its alerts, and the access tokens for its connected accounts, and we remove the accounts of anybody who was only there for that business. It is done within 30 days, and backups made before then age out within a further 30 days.

Two things we cannot delete for you:

• Posts already published. They are on the platform, not here. Delete them in that platform's own app.
• Records the law requires us to keep, such as invoices once you are paying for the service. These never include your photos, your captions or your posts.

You can also disconnect any social account at any time without deleting anything else.

How to get a copy of it

Sign in, open your business's Settings page, and choose Download everything. You get a single file holding your photos and videos, the captions written for them, every post and what happened to it, who approved or edited what, and who can sign in for you. No waiting, no fee, no need to ask us.

This business export does not include every connected-tool or desktop record, as explained above. It also leaves out: passwords and account logins (we keep no passwords, and the logins for your connected accounts are encrypted and never exported), posts already published on a platform, and anything belonging to anybody else.

Your rights

We are established in Malaysia, so the Personal Data Protection Act 2010 governs what we do with your data, wherever you are. The service is open to businesses anywhere in the world, so where the law of your own country gives you more than this policy does, you have that as well — including the GDPR in the European Union and the UK GDPR in the United Kingdom.

We hold and use your data for one purpose only: to run this service for you — to make the posts you ask for, to authenticate your account, provide the Jarvis features you request, and show you what went out. What allows us to do each part of that:

• The agreement between us. We cannot make your posts without the photos, videos and captions you send, the accounts you connect, and the name and email address of each person who signs in.
• Keeping the service safe and working, a legitimate interest of ours and of every business that uses it: the server logs, the backups, and the record of who approved what, so that a post can always be shown to have been agreed to.
• The law, for the records it requires us to keep, such as invoices once you are paying for the service.
• Your consent, which the Personal Data Protection Act asks for and which you give by signing up. You can withdraw it at any time by asking us to delete your business, as above; doing so ends the service, because there is nothing left to run it on.

You may ask to see a copy of what we hold, to correct it, to have it deleted, to limit how we use it, to object to how we use it, or to take it with you to another service. The copy is a button, above, and it is also the file you would take with you. For anything else, write to aidanpartners23@gmail.com: we will answer within 21 days, and none of it costs anything.

A photo a business sends may show its customers or its staff. The business chooses what it sends and what is posted, so it is the one to have their agreement; we handle those photos only to make the posts it asks for, and only as this policy describes.

Your data is kept in Singapore, as above, and what you post goes to the platforms, which are run by companies based in the United States and elsewhere — for most businesses, outside their own country.

If you are not satisfied with our answer, you can complain to the Personal Data Protection Commissioner of Malaysia — or, in the European Union, to the data protection authority of your country, and in the United Kingdom to the Information Commissioner's Office.

Cookies

Laras uses essential cookies for sign-in, request protection and temporary OAuth connection state. These support account security and linking accounts. Laras does not use these cookies for advertising.

Changes

If this policy changes, the new version appears on this page with a new date. If the change matters to you, we will say so by email.