Privacy Policy

Information you provide directly:

• Account data: name, email address, password (hashed), profile photo.
• Billing data: payment card details processed by Stripe, never stored on our servers.
• Content: posts, captions, images, and videos you schedule through Sociro.
• Communications: messages you send via the contact form or email.

Information collected automatically:

• Usage data: pages visited, features used, click events, session duration.
• Device data: browser type, OS, IP address, time zone.
• Cookies & tracking: see our Cookie Policy.

From connected social platforms:

• Facebook, Instagram, X (Twitter), LinkedIn, TikTok, Pinterest, Threads, YouTube, and Google My Business APIs, collected when you connect accounts.
• Google OAuth if you sign in with Google.

• To operate, maintain, and improve the Service.
• To schedule and publish social media content across all supported platforms on your behalf.
• To process payments and manage subscriptions.
• To send transactional emails (account confirmation, billing receipts, publish notifications).
• To respond to support requests.
• To detect fraud and ensure security.
• To comply with legal obligations.

We do not sell your personal data to third parties.

• Service providers: Stripe (payments), AWS / Cloudflare R2 (storage), Mailgun (email), and similar infrastructure partners bound by data processing agreements.
• Social platforms: data is transmitted to the platforms you explicitly connect: Facebook, Instagram, X, LinkedIn, TikTok, Pinterest, Threads, YouTube, Google My Business.
• Legal requirements: if required by law, court order, or to protect our rights.
• Business transfers: in connection with a merger or acquisition. We will notify you in advance.

You can connect an AI assistant, such as ChatGPT or Claude, to your Sociro account so it can list your accounts and schedule, publish, edit or cancel posts when you ask it to. This section explains what that connection involves. The rest of this policy applies to it as well.

What we collect:

• Requests: only what the assistant sends to carry out your request: the brand and accounts to use, the text of a post, a link to an image or an uploaded media file, the date and time, and post settings such as a first comment or a video title.
• Connection record: the workspace and brands you allowed, what you allowed the assistant to do, who approved it and when.

We do not receive your conversation with the assistant, your prompts, or your chat history.

How we use it: to do what you asked, to show the connection in your settings so you can manage it, and to keep the service secure. We do not use it for advertising and we do not sell it.

Who receives it:

• Social platforms: a post you ask the assistant to schedule or publish is sent to the platforms you chose, the same as a post made in the Sociro app.
• Your AI provider: the answers to the assistant's requests (for example your brand and account names, and the details of your posts) go back to the assistant. Your conversation, and what the provider does with those answers, is covered by that provider's own terms and privacy policy. Sociro does not control it.
• Service providers: the infrastructure partners listed under "Data Sharing".

How long we keep it:

• The connector itself stores no key and nothing about you between requests.
• Posts and media created through an assistant are kept like any other content in your Sociro account, as described under "Data Retention & Deletion".
• When you disconnect an assistant, its access ends at once and its sign-in tokens are deleted. A connection also ends by itself if it is not approved again within 365 days.
• The record that a connection existed (which app, who approved it, and when it was connected and ended) is kept with your workspace and deleted with your account, as described under "Data Retention & Deletion".

Your controls:

• When you connect, you choose what the assistant may do: read only, post, or add media, for every brand or one brand.
• You can disconnect an assistant at any time in Settings, Developer API.
• Your rights to access, correct and delete your data, described under "Your Rights", apply here too.

We retain your account data as long as your account is active. After deletion, we purge personal data within 30 days, except where longer retention is required by law or for fraud prevention.

To delete your account, go to Settings → Account → Delete Account, or email [email protected].

We use industry-standard security practices including:

• TLS encryption in transit.
• AES-256 encryption for sensitive tokens at rest.
• Regular security audits and penetration testing.

No system is 100% secure, so please use a strong, unique password and enable two-factor authentication where possible.

Depending on your location you may have rights to:

• Access, correct, or delete your personal data.
• Object to or restrict processing.
• Data portability: receive a copy of your data in a structured format.
• Withdraw consent at any time.

To exercise these rights, email [email protected].

We may update this policy from time to time. We will notify you of material changes via email or in-app notice at least 14 days before they take effect.