Privacy Policy

01Scope

This Policy applies to personal information we collect through the Site, by email, phone, or other communications, and in the course of providing our Services. It does not apply to:

• Personal information we process on behalf of our clients as a service provider or data processor. That processing is governed by our agreements with those clients, and individuals should contact the relevant client directly.
• Personal information of job applicants, employees, and contractors, which is described in a separate notice provided at the time of collection.

02Information We Collect

2.1 Information You Provide to Us

• Contact details: name, email address, phone number, and mailing address.
• Professional details: company or organization name and job title.
• Account information: username and password, if you create an account.
• Project and communication details: the content of your inquiries, project requirements, and messages you send us.
• Billing information: billing name and address. Payment card details are collected and processed directly by our third-party payment processors, which follow the Payment Card Industry Data Security Standard (PCI DSS). We do not store full payment card numbers.

2.2 Information Collected Automatically

• IP address and approximate location (city or region) derived from it
• Browser type, device type, operating system, and device identifiers
• Pages visited, time spent on pages, links clicked, and referring URLs
• Information collected through cookies, pixels, and similar technologies (see Section 4)

2.3 Information from Third Parties

• Analytics providers, such as Google Analytics
• Advertising and marketing partners
• Social media platforms, when you interact with our pages or content on those platforms
• Business partners and referral sources
• Publicly available sources, such as professional networking sites

2.4 Sensitive Personal Information

We do not intentionally collect sensitive personal information such as Social Security numbers, government ID numbers, precise geolocation, health information, biometric data, financial account credentials, or information about racial or ethnic origin, religion, or sexual orientation.

Account login credentials (a username together with a password) are treated as sensitive personal information under California law and as sensitive personal data under India’s SPDI Rules. We use them only to provide secure access to your account and to protect the Services, and we do not use any sensitive personal information to infer characteristics about you. If a specific service ever requires other sensitive information, we will ask for your explicit consent first.

03How We Use Information

We use personal information for the following business and commercial purposes:

• To provide, operate, and maintain the Services and fulfill your requests and contracts
• To respond to inquiries and provide customer support
• To process payments and manage billing
• To create and manage accounts
• To send service-related notices, and, where permitted, newsletters and marketing communications (see Section 14)
• To personalize your experience and improve the Site and Services
• To perform analytics and measure the effectiveness of our marketing
• To detect, prevent, and respond to security incidents, fraud, and misuse
• To comply with legal obligations and enforce our terms

We will not use personal information for purposes that are materially different from, unrelated to, or incompatible with these purposes without giving you notice and, where required by law, obtaining your consent.

04Cookies, Tracking & Do Not Track

We and our partners use cookies, pixels, and similar technologies for the following purposes:

Third parties, such as analytics and advertising providers, may collect information about your online activities over time and across different websites when you use the Site. If you block cookies, some parts of the Site may not work properly.

Do Not Track: Because there is no common industry standard for “Do Not Track” browser signals, the Site does not currently respond to them.

Global Privacy Control: We treat a Global Privacy Control (GPC) signal from your browser as a valid request to opt out of the sale or sharing of your personal information, and of targeted advertising, for that browser or device, as required by California and other state laws.

05How We Disclose Information

We may disclose personal information to the following categories of recipients:

• Service providers and processors that perform services for us, such as website hosting, IT and security, email delivery, customer support, and analytics. They are contractually required to use personal information only to provide services to us and to protect it.
• Payment processors to complete transactions.
• Advertising and analytics partners through cookies and similar technologies, as described in Section 4.
• Professional advisors, such as lawyers, auditors, and accountants.
• Affiliated entities within our corporate group, when needed to deliver the Services.
• Government authorities and law enforcement, when required by law or legal process, or to protect our rights, property, or safety, or those of others.
• Parties to a business transaction, such as a merger, acquisition, financing, or sale of assets, subject to standard confidentiality protections.
• Other parties with your consent or at your direction.

06Categories of Personal Information (CCPA)

In the preceding 12 months, we have collected the following categories of personal information, as defined by the CCPA. Sources are described in Section 2, purposes in Section 3, and retention in Section 8.

07International Data Transfers

We operate in the United States and India, and our service providers may be located in other countries. Your personal information may therefore be transferred to, stored in, and processed in countries other than the one where you live, which may have different data protection laws. When we transfer personal information, we protect it with contractual safeguards such as data processing agreements, along with encryption and other security measures. Transfers of personal data out of India are made in compliance with the DPDP Act and any restrictions notified under it.

08Data Retention

We keep personal information only for as long as reasonably necessary for the purposes described in this Policy. We use the following criteria to determine retention periods:

When personal information is no longer needed, we delete it or de-identify it. You may request deletion at any time; see Sections 10 to 12.

09Security

We use reasonable administrative, technical, and physical safeguards to protect personal information. These include TLS (SSL) encryption in transit, access controls based on job need, secure hosting, and periodic reviews of our security practices. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If a data breach affects your personal information, we will notify you and the relevant authorities as required by applicable U.S. state breach-notification laws and Indian law.

10Your U.S. Privacy Rights

10.1 California Residents

Subject to certain exceptions, California residents have the following rights under the CCPA:

We do not offer financial incentives in exchange for personal information.

California “Shine the Light” (Cal. Civ. Code § 1798.83): California residents may ask once per year for information about any personal information we disclosed to third parties for their own direct marketing purposes in the preceding calendar year. We do not disclose personal information to third parties for their own direct marketing purposes.

10.2 Residents of Other U.S. States

Depending on where you live, and where the law applies to us, residents of states with comprehensive privacy laws may have some or all of the following rights. These states include Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia.

• To confirm whether we process your personal data and to access it
• To correct inaccuracies in your personal data
• To delete your personal data
• To obtain a copy of your personal data in a portable format
• To opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects

10.3 Nevada Residents

Nevada residents may submit a request to opt out of the sale of covered information under Nevada Revised Statutes Chapter 603A by emailing us at the address in Section 18.

11How to Exercise Your Rights

Opt out of sale, sharing, or targeted advertising: use the “Do Not Sell or Share My Personal Information” link in the Site footer, or turn on Global Privacy Control in your browser.

Verification: To protect your information, we will verify your identity before responding to requests to know, delete, or correct. We do this by matching information you give us with information we already hold. We may ask for additional information for this purpose, and we will use it only for verification. Opt-out requests do not require verification.

Authorized agents: You may use an authorized agent to submit a request on your behalf. We may require the agent to provide your signed written permission, and we may ask you to verify your identity directly with us.

Response timing: We will confirm receipt of your request within 10 business days and respond within 45 calendar days. If we need more time, we may extend the response period by up to another 45 days, and we will tell you why. Requests are free of charge unless they are manifestly unfounded or excessive.

12Your Rights Under Indian Law

If you are in India, you have the following rights under the DPDP Act:

• To obtain a summary of your personal data and of the processing activities carried out on it
• To correct, complete, or update your personal data
• To have your personal data erased
• To withdraw consent at any time. Withdrawal does not affect processing carried out before you withdraw.
• To nominate another person to exercise your rights in the event of your death or incapacity
• To have your grievances addressed. You may contact our Grievance Officer (Section 17), and if your grievance is not resolved, you may approach the Data Protection Board of India.

13Children’s Privacy

The Services are intended for businesses and adults, and are not directed to children under 13. We do not knowingly collect personal information from children under 13, as required by the Children’s Online Privacy Protection Act (COPPA). We also do not knowingly sell or share the personal information of consumers under 16. For users in India, we do not knowingly process the personal data of anyone under 18 without verifiable parental consent, as required by the DPDP Act. If you believe a child has given us personal information, please contact us and we will delete it promptly.

14Marketing Communications

You can unsubscribe from our marketing emails at any time by clicking the “unsubscribe” link in any email or by contacting us. We will process your request within 10 business days, as required by the CAN-SPAM Act. We send marketing text messages only with your prior express consent, and you can opt out at any time by replying STOP. Even if you opt out of marketing, we may still send you transactional or service-related messages.

15Third-Party Links and Services

The Site may contain links to third-party websites, plug-ins, and services. We are not responsible for their privacy practices, and we encourage you to read their privacy policies.

16SocialFlow and Connected Social Accounts

SocialFlow is our service that prepares social media posts for a business, lets that business approve them, and publishes approved posts to the business’s own social media accounts. This section explains what we access when a business connects an account to SocialFlow.

What we access

When you connect a Facebook Page, Instagram business account, Threads profile, Google Business Profile, LinkedIn Page, Pinterest account, X account or Reddit account, you sign in on that platform and grant SocialFlow permission. We never see or store your password. Depending on the platform and the permissions you grant, we receive:

• an access token that lets SocialFlow publish on your behalf;
• basic details of the account or page (name, ID, profile picture, and the pages or locations you manage);
• the posts SocialFlow publishes, and their public performance figures, such as reach, likes, comments and clicks.

How we use it

We use this data only to:

• publish the posts you have approved, at the times you choose;
• show you your scheduled and published posts;
• report post performance to you.

We do not use data from these platforms for advertising, we do not sell it, and we do not use it to build profiles of people who interact with your posts.

AI-generated content

SocialFlow uses AI services (currently Anthropic’s Claude) to draft post text, based on the business information you give us. We send the AI service your business details and brand guidelines. We do not send data received from social platforms beyond what is needed to write or improve your posts. Our AI provider processes this data under its commercial terms and does not use it to train its models.

Sharing

We share connected-account data only with the platform it came from (to publish), with service providers who host or run SocialFlow for us under confidentiality obligations, or where the law requires it.

Google user data

SocialFlow’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Retention

We keep access tokens only while your account is connected. We keep your posts and their performance figures for the length of your SocialFlow subscription plus 90 days, unless you ask us to delete them sooner.

Disconnecting and deletion

You can disconnect any account at any time, in SocialFlow or in the platform’s own settings. Within 30 days of a deletion request, we delete the tokens and data received from that platform. See How to delete your SocialFlow data.

17Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will post the revised version on this page and update the “Last Updated” date. If we make material changes, we will provide additional notice, such as a notice on the Site or an email, and we will obtain your consent where the law requires it.

18Grievance Officer (India)

In accordance with the Information Technology Act, 2000, the rules made under it, and the DPDP Act, our Grievance Officer is:

19Contact Us

If you have questions about this Privacy Policy or our privacy practices, or need this Policy in an alternative format for accessibility reasons, please contact us: