SocialOS

Draft: company details are not filled in yet (LEGAL_* settings). Have this text reviewed by a lawyer before publishing.

Privacy Policy

Effective [Effective date]

This policy explains what personal data SocialOS (operated by [Company legal name], [Registered address], "we") collects, why, who we share it with, and the choices you have. Questions: [privacy contact email].

1. Who this applies to

SocialOS is a service businesses use to manage their social media. It applies to people who sign up or are invited to a workspace ("users"), and to people whose public comments on our customers' posts we process on our customers' behalf. For that comment data, our customer is the controller and we act as their processor.

2. Data we collect

  • Account data: your email address, a password (stored hashed by our authentication provider), your organizations, brands, team roles and invitations.
  • Connected social accounts: when you connect a Facebook Page, Instagram, Threads, LinkedIn Page, X, YouTube or TikTok account, we receive the account's id, name, picture and access tokens for the permissions you approve. Tokens are encrypted and kept in a separate secrets store; they are never shown in the app.
  • Your content: posts, captions, images, videos and documents you upload or generate, schedules, brand guidelines ("Brand Brain"), research ideas and approval notes.
  • Data from social platforms about your posts: publishing status, performance metrics (views, likes, comments, shares and similar), and comments on your posts, including the commenter's public name or username and the comment text.
  • Tracked links and conversions: when someone clicks a SocialOS tracked link in a post, we record the time, the link, the visitor's country and the referring site, and an anonymous visitor id made from a one-way hash of their IP address and browser with a secret that changes every day. We don't store IP addresses. If our customer installs our snippet on their website, it keeps the click id in a first-party cookie on that site for up to 90 days, and the site reports conversions (for example a signup or purchase, with an optional value and order id) linked to that click. Customers are responsible for telling their visitors and collecting consent where the law requires.
  • Billing data: your plan and subscription status. Card details are collected and stored by Stripe, not by us.
  • Technical data: logs of actions in the workspace (audit log), AI usage records (what feature was used, cost and a short summary of the request), and standard server logs from our hosting providers (such as IP address and browser type).

We only use cookies that are needed for the service to work: your sign-in session and which organization and brand you have selected. We don't use advertising or third-party analytics cookies.

3. How we use it

  • To provide the service: publish and schedule posts, show analytics and comments, send replies you write, and run the AI features you use.
  • To send service emails: alerts about failed posts or disconnected accounts, invitations, approval requests and billing notices.
  • To bill you, prevent abuse, keep the service secure, and meet legal obligations.

We don't sell personal data, don't use it for advertising, and don't use data received from social platforms for any purpose other than providing the features you use.

4. AI features

When you use an AI feature (writing or checking posts, research, graphics text, image generation, insights or reply suggestions), the relevant content is sent to an AI provider to produce the result: for example your brand guidelines and draft, or a comment and the post it is on. Results are suggestions: nothing is published without a person choosing to publish it. Providers process this data under their terms for business customers.

5. Who we share data with

We use these service providers ("subprocessors") to run SocialOS:

  • Supabase: database, authentication and file storage.
  • [Hosting provider, e.g. Vercel]: application hosting.
  • Stripe: payments and subscriptions.
  • Resend: sending email.
  • Anthropic: AI text features.
  • Cloudflare, Google (Gemini) and OpenAI: AI image generation, only when you choose that option.
  • Pexels: stock photo search (your search terms).
  • The social platforms you connect, to publish your content and read metrics and comments.

We may also disclose data if required by law, or as part of a merger or acquisition, in which case this policy continues to apply.

6. Social platforms

YouTube and Google

SocialOS uses YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service, and Google's use of data is described in the Google Privacy Policy. You can revoke SocialOS's access at any time in your Google account permissions. SocialOS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Meta (Facebook, Instagram, Threads), LinkedIn, X and TikTok

We access these platforms only with the permissions you approve when connecting an account, and only to provide the features described above. You can remove access in SocialOS (Accounts → Disconnect) or in the platform's own settings. See Data deletion for how to have your data removed.

7. Security

Data is encrypted in transit. Access to each organization's data is restricted to its members by database-level rules. Platform access tokens are stored encrypted in a separate secrets store. We limit staff access to what is needed to operate and support the service.

8. How long we keep data

We keep your data while your account or organization exists. When an organization is deleted, its content, files, connected accounts (and their tokens), metrics and comments are deleted immediately from the live service; backups are overwritten within [30] days. Billing records are kept as long as tax law requires. Comments and metrics stop being collected 30 days after a post is published.

9. Your rights

Depending on where you live (for example under GDPR or CCPA) you can ask to access, correct, export or delete your personal data, object to or restrict processing, and withdraw consent. You can delete your account and organizations yourself in Settings, or email [privacy contact email]. You can also complain to your data protection authority. If you commented on a post managed with SocialOS, contact the brand that owns the post, or us and we'll pass your request on.

10. International transfers

Our providers may process data outside your country. Where required, transfers are covered by appropriate safeguards such as Standard Contractual Clauses. [Confirm regions.]

11. Children

SocialOS is a business service and is not intended for anyone under 16.

12. Changes

We'll post changes here and, for significant changes, notify account owners by email before they take effect.