Privacy Policy

Overview #

This Privacy Policy explains how Social8 ("Social8", "we", "us") handles personal data when you visit our website, create an account, connect a social or business platform, or otherwise use the Social8 service (the "Service"). It applies together with our Terms of Service.

Information we collect #

Account information. Name, email address, and password (stored as a salted hash, never in plain text) when you register directly, or when you sign in with Google or Apple: your name, email address, profile picture, and the provider's account identifier. If you sign in with Apple and choose to hide your email, we receive and store Apple's private relay address instead of your real one.

Connected-platform data. When you connect a platform such as Facebook, Instagram, Threads, LinkedIn, X, TikTok, YouTube, Pinterest, Google Business Profile, or Bluesky, we store the access tokens needed to publish on your behalf, together with identifiers and public details for the Pages, profiles, channels, or locations you connect (for example, page or channel ID, name, and avatar), the content and media you create and approve for publishing, the results of publishing attempts (success, failure, and platform-assigned post IDs), and, where a platform's API makes it available, basic performance analytics for posts published through Social8.

Early access and contact information. If you join our early access list or contact us, we store your email address, the type of business you run, your IP address, your browser's user agent, and the page that referred you, so we can respond and understand demand.

Usage and device information. Standard technical data such as IP address, browser and device details, and pages visited, collected automatically as part of running the website and service, including through the cookies described in our Cookie Policy.

How we use information #

• To provide the Service: create your account, connect and publish to the platforms you authorise, and generate AI-assisted captions and images from the information you give us.
• To operate your subscription: billing, plan allowances, and support.
• To communicate with you: service messages, security alerts, and responses to enquiries; lead and contact notifications are also routed internally to our team by email and Telegram.
• To keep the Service secure and working: fraud and abuse prevention, debugging, and maintaining reasonable performance.
• To meet legal obligations, including responding to lawful requests and the platform-specific data-deletion obligations described below.

We do not use the content of your posts, images, or account data to train generalised, cross-customer AI models, and we do not sell your personal information.

Legal bases for processing (GDPR) #

Where the EU/UK General Data Protection Regulation applies, we rely on: performance of a contract (providing the Service you signed up for), legitimate interests (securing the Service, preventing abuse, and improving it), consent (for example, where a platform's API requires you to expressly consent before we publish, such as TikTok's Direct Post preview and consent step, or where you opt in to marketing), and legal obligation (for example, responding to a verified account-deletion request).

Sharing and subprocessors #

We do not sell personal information. We share data only with:

• Connected platforms you authorise, to the extent needed to publish and report on your content there.
• Infrastructure and hosting providers, including our server host and Cloudflare, which sits in front of our site as a content delivery network and security layer.
• AI model providers, to generate captions and images from the business information and prompts you supply.
• Payment processors, to process subscription billing; we do not store full card numbers ourselves.
• Email and messaging providers, to deliver account and notification messages.
• Professional advisers and authorities, where necessary to comply with the law, enforce our Terms, or protect rights, safety, and property.

Each category above acts as a processor or subprocessor bound by contract or platform terms to use the data only to provide their service to us, unless you interact with them directly under their own terms (as you do when authorising a platform connection).

International transfers #

We and the providers listed above may process data in countries other than your own, including the United States. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on recognised safeguards such as Standard Contractual Clauses or an equivalent lawful transfer mechanism offered by the receiving provider.

Data retention #

• Account data is kept for as long as your account is active, and deleted within 30 days of a verified account-deletion request, with backup copies purged within 90 days.
• Connected-platform access tokens are deleted immediately when you disconnect that platform, or within 30 days of account deletion, whichever is earlier.
• Published-content records and delivery results are kept for as long as your account is active, to show your publishing history, and are deleted with your account as above.
• Early access and contact submissions are kept for as long as reasonably needed to follow up, and are deleted or anonymised when no longer needed for that purpose.
• Meta data-deletion requests made through the callback described in our Data Deletion page are recorded (status and confirmation code) for our compliance records even after the underlying data is deleted.

Security #

We use administrative, technical, and physical safeguards appropriate to the data we hold, including encrypted connections (HTTPS), hashed passwords, access controls on connected-platform tokens, and a security-focused CDN in front of our infrastructure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Your rights #

GDPR and UK GDPR. If you are in the EEA or UK, you have the right to access, correct, delete, restrict, or port your personal data, and to object to certain processing. You can exercise these rights by emailing [email protected], and you have the right to lodge a complaint with your local data protection authority.

CCPA/CPRA. If you are a California resident, you have the right to know what personal information we collect, to request deletion, and to correct inaccurate information. We do not sell or "share" (as that term is defined under the CPRA, including for cross-context behavioural advertising) your personal information.

For any request, we may need to verify your identity before acting on it. You can delete your own data directly at any time as described on our Data Deletion page.

Google: Sign in with Google, YouTube, and Google Business Profile #

Social8 uses Google user data for Sign in with Google (name, email, profile picture, and account identifier), for publishing videos you upload to your own YouTube channel, and for publishing updates to Google Business Profile locations you manage. We access and store only what each feature needs: your basic profile for sign-in, and, for YouTube, channel identifiers, video upload metadata, and upload/publish status for videos you choose to upload through Social8. We do not access your YouTube watch history, subscriptions, or any Google data unrelated to the features you connect, and we do not use Google user data to train generalised or cross-customer AI models.

Google API Services User Data Policy. Social8's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

YouTube API Services. Social8's YouTube features use YouTube API Services. By using those features you also agree to the YouTube Terms of Service. You can review Google's own data practices in the Google Privacy Policy.

You can revoke Social8's access to your Google account, including Sign in with Google and YouTube, at any time at Google's third-party access settings. Disconnecting a Google-based platform in Social8, or revoking access from Google's side, deletes the access tokens we stored for that connection.

Meta: Facebook, Instagram, and Threads #

When you connect a Facebook Page, an Instagram professional account, or a Threads profile, we request only the permissions each feature needs (for example, page management and content publishing permissions), and we access, store, and use the data those permissions provide — page/account identifiers, names, avatars, the content you publish, and publishing results — solely to operate the Service for you.

You can review and remove Social8's access at any time from Facebook's Settings & privacy > Settings > Apps and websites, or the equivalent "Apps and Websites" section in Instagram settings. Full instructions, including Meta's Data Deletion Request Callback, are on our Data Deletion page.

TikTok, LinkedIn, X, Pinterest, Bluesky, and Apple #

• TikTok: we store the access token, basic account identifiers, and the videos/photos and captions you submit through TikTok's Content Posting API, together with each upload's status. TikTok's Direct Post flow requires us to show you a preview and obtain your express consent before each upload. Revoke access any time in the TikTok app under Settings and privacy > Security and permissions > Manage app permissions.
• LinkedIn: we store the access token, the identifiers of the company page or member profile you authorise, and the content and publishing results for posts sent through Social8. Revoke access at linkedin.com/psettings/permitted-services.
• X: we store the access token, your account identifier, and the content and publishing results for posts sent through Social8. Revoke access at Settings and privacy > Security and account access > Apps and sessions > Connected apps on x.com.
• Pinterest: we store the access token, your business account and board identifiers, and the pins published through Social8. Revoke access under Pinterest Settings > Security > Apps.
• Bluesky: instead of OAuth, Bluesky uses an app password you generate yourself; we store that app password and your handle to publish on your behalf. Revoke access by deleting the app password in the Bluesky app under Settings > App Passwords, or by telling us to disconnect it.
• Apple (Sign in with Apple): we store the name, email (or Apple private relay email if you choose to hide it), and Apple account identifier Apple provides at sign-in. Because Apple's private relay forwards mail to your real address without revealing it to us, we never see your real email if you choose that option. Revoke access at appleid.apple.com under Sign-In and Security > Apps Using Apple ID.

For every platform above, disconnecting it inside Social8 immediately deletes the access token and platform-specific credentials we stored for that connection, whether you disconnect from inside Social8 or revoke access from the platform's own settings.

AI model providers #

Social8 sends the business information, prompts, and (where relevant) images you provide to third-party AI model providers in order to generate captions and images. Where a provider offers a business or API-tier setting that excludes customer content from being used to train their own general-purpose models, we configure our use of that provider accordingly. We cannot control a provider's infrastructure directly, and this is a configuration commitment rather than a guarantee about how every provider's systems work; we do not knowingly use your content to train generalised, cross-customer AI models ourselves.

Children's privacy #

Social8 is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us at [email protected] and we will delete it.

Cookies #

Social8 uses a small number of strictly necessary cookies to keep you signed in and to protect the site. See the full list on our Cookie Policy.

Changes to this policy #

We may update this Privacy Policy to reflect changes to the Service, the platforms we integrate with, or the law. We will update the "Last updated" date above, and for material changes we will make reasonable efforts to notify you.

Contact #

For privacy questions, access or deletion requests, or to reach our data protection contact, email [email protected].