Privacy Policy

Last updated: November 1, 2026

SOCIA (sociaos.com) is an AI social media strategist operated by SOCIA LLC, a Tennessee company. This policy describes what information SOCIA collects, why, who helps us process it, how long we keep it, and the choices you have. It is written to be read, not skimmed past.

What we collect

• Account information: your email address and password (stored hashed), or, if you sign in with Google, the name, email address and profile picture Google shares. We also keep your plan and, if you pay, your billing status (see Payments below).
• Instagram: when you connect an Instagram professional account, Meta gives us an access token and, with the permissions you approve (instagram_business_basic, instagram_business_manage_insights, instagram_business_content_publish, instagram_business_manage_comments), we read your profile, follower counts, your posts and their metrics and insights, and the comments on your posts. This includes collab posts you joined as a collaborator, with the posting account's username and the post's totals. We publish only posts you schedule and reply to a comment only when you approve the reply.
• Facebook Pages: when you connect a Facebook Page, Meta gives us access tokens and, with the permissions you approve (pages_show_list, pages_read_engagement, pages_read_user_content, pages_manage_posts, pages_manage_engagement, read_insights, instagram_basic, instagram_manage_contents, business_management), we read the Page's details, posts, engagement, insights and comments. We publish and reply only when you do. We keep your Facebook user token next to the Page token because Meta lets an Instagram post be deleted only with it; we use it, and instagram_manage_contents, only to delete a post from the Instagram account linked to your Page when you ask SOCIA to.
• YouTube: when you connect your channel, Google gives us OAuth tokens and we read, with read-only permissions (youtube.readonly, yt-analytics.readonly), your channel details, your videos and your own YouTube analytics (views, watch time, subscriber changes and the age breakdown of your viewers), solely to show them back to you in SOCIA and base recommendations on them. Only if you turn on YouTube publishing do we ask for the youtube permission, and we use it only to upload a video you schedule, set its details and add it to a playlist you choose.
• TikTok: when you connect a TikTok account, TikTok gives us access tokens and, with the permissions you approve (user.info.basic, user.info.profile, user.info.stats, video.list, video.upload), we read your profile, follower and video counts, and your public videos and their counts, and send a video you schedule to your TikTok account. If TikTok approves direct posting, we also ask for video.publish to post a video you schedule.
• Other accounts' public information: when you track competitors or explore your niche, SOCIA reads public profile and post information about other accounts through the platforms' APIs and public web research, to compare it with yours.
• Comments on your posts: for AI comment replies, we store the commenter's name or username, the comment and the post's caption, alongside the reply SOCIA suggests. Nothing is sent until you approve it.
• Content you create or upload: captions, drafts, notes, and the images and videos you schedule. In Content Studio, a video you analyze is read in your browser, which sends sampled frames for analysis; its sound is uploaded briefly for transcription. Clips you add to Build or Edit are uploaded to private storage so SOCIA can analyze them and you can edit them and use them again later.
• Brand and profile details you provide: your niche, goals, location and brand settings, used to personalize analysis.
• Teams and workspaces: the people you invite, their roles, and who submitted, approved or published a post.
• AI assistants you connect: if you connect SOCIA to an AI assistant such as Claude or ChatGPT, we keep which assistant you connected, when, whether you let it post, and a log of its requests (what it asked for, the result and the time). If it gives SOCIA a link to an image or video for a post, we download that file once and store it like media you upload yourself.
• Usage records: product events such as viewing the pricing page, reaching a plan limit or upgrading, and how much AI processing each feature used, so we can set fair plan limits. Our hosting keeps server logs for operating and debugging the service.

How we use it

• To analyze your accounts and generate scores, plans, captions, reply suggestions, alerts and summaries.
• To publish what you schedule, at the time you schedule it, and to reply to comments when you approve a reply.
• To delete a post from Instagram, Facebook or YouTube when you ask SOCIA to, and to keep a record of that deletion with the last numbers SOCIA measured for the post.
• To run teams, workspaces, approvals and billing.
• To operate, secure, debug and improve the product, and to prevent abuse.

We do not sell your data, we do not share it for advertising, and we do not use it to advertise to you.

Who processes it for us

We share data only with the services that run SOCIA, and only what each needs:

• Supabase: database, sign-in and file storage.
• Vercel: hosting and server logs.
• Anthropic (Claude): SOCIA's analysis and writing. The material a feature needs (for example your posts and their metrics, captions, brand details, comments, video frames or transcripts) is sent to Anthropic to produce the result. Competitor research also uses Anthropic's web search. Under Anthropic's commercial terms, this data is not used to train its models.
• AssemblyAI: speech-to-text for videos you analyze, caption or build from. For a video you analyze or caption, the audio file is deleted from our storage as soon as the transcript is back; for Build from Clips it is kept with the clip's footage and deleted with it.
• ElevenLabs: makes the original music tracks in a video's playlist. Only a description of how each track should sound (genre, mood, tempo, instruments, length) is sent; no video, voice or personal details. The tracks are stored privately with the project's clips.
• Stripe and Link: payments, sales tax and receipts.
• Google Fonts: Content Studio's video previews load a font from Google Fonts in your browser.
• The platforms you connect (Meta for Instagram and Facebook, Google for YouTube and Google sign-in, TikTok): we exchange data with them only as described above.
• AI assistants you connect: when you connect an assistant, it can ask SOCIA for your workspace's analytics, and SOCIA answers it. If you turn on posting for it (on a paid plan), it can also ask SOCIA to create, schedule or publish posts to the accounts in the workspaces you shared, and SOCIA publishes them to Instagram or Facebook exactly as if you had used Create post. What the assistant does with your data is governed by its own terms. It never receives your platform access tokens, and you can turn off posting or disconnect it at any time in Settings, under AI Assistants.

We may also disclose information when the law requires it, or as part of a merger or acquisition, subject to this policy.

Payments

Payments are handled by Stripe and Link. Your card details go to them, never to SOCIA. We keep your Stripe customer and subscription identifiers, your plan, the subscription status and its billing dates. Stripe's and Link's handling of your payment information is covered by their own privacy policies.

Where it lives

Data is stored with Supabase (database, sign-in and files) and the app is hosted on Vercel. Access tokens for connected platforms are stored server-side and never exposed to your browser, other users or AI assistants. Media you schedule is stored at an unlisted web address so the platform can fetch it when it publishes.

How we protect your data

We treat connected-account access tokens and the profile, content and analytics data we read on your behalf as sensitive, and protect them with the following mechanisms:

• Encryption in transit: all traffic between your browser, SOCIA and the platform APIs is encrypted with HTTPS/TLS.
• Encryption at rest: data, including access and refresh tokens, is stored in a managed PostgreSQL database (Supabase) that encrypts data at rest.
• Access controls: every record is scoped to your account and workspace with database row-level security, so no user can read another user's data, and team members see only the workspaces they were invited to. OAuth tokens are held server-side only and are never sent to the browser. Sign-in tokens for AI assistants are stored only as hashes. Access to production systems is limited to authorized personnel for operating and supporting the service.
• Least privilege: we request read-only permissions wherever a feature allows it, and use a write permission only for an action you explicitly take, such as publishing a post you scheduled or sending a reply you approved.

How long we keep it

• Your account data, for as long as your account exists.
• A connected account's tokens, synced data and daily history, until you disconnect it (see below).
• Clips you upload to Content Studio, with their frames and audio, until you delete them, their project or your account, so you can post them again or use them in a new video. Audio from a video you analyze or caption is deleted as soon as the transcript is back.
• Media you schedule, until you delete the post.
• The record of a post you deleted from a platform through SOCIA (when, by whom, its link, the start of its caption and its last measured numbers), for as long as your account exists, so your results history stays complete.
• AI assistant sign-in tokens expire after an hour (renewal tokens after 30 days) and are removed within a week of expiring; the log of an assistant's requests is kept for 180 days.
• Changing to a smaller plan never deletes your data: anything beyond the new plan is paused until you upgrade again or choose what to keep.

Deleting your data

Disconnecting a social account in Settings deletes its stored tokens, the synced profile and posts, and the daily history SOCIA recorded for that account. Removing SOCIA from your Instagram or Facebook settings triggers the same deletion automatically through Meta's deletion callback; see Data deletion for the steps and to check a confirmation code. To delete your SOCIA account and all associated data, email socia.app2026@gmail.com from the address you signed up with and we will remove it within 30 days.

Your choices

• You can ask for a copy of your data, or ask us to correct or delete it, by emailing socia.app2026@gmail.com.
• You can disconnect any social account or AI assistant in Settings, and revoke SOCIA's access from the platform itself: for Google and YouTube at myaccount.google.com/permissions, and in the apps and websites settings of Instagram, Facebook and TikTok.
• SOCIA uses cookies only to keep you signed in and to complete a connection with a platform, and your browser's storage for display preferences. There are no advertising or third-party analytics cookies.

Google user data and Limited Use

SOCIA's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained from your connected YouTube channel is used only to provide and improve the analytics and recommendations you see in SOCIA. We do not sell it, we do not use it for advertising, and we do not use it to develop, improve or train generalized AI or machine-learning models; when it is sent to Anthropic to produce your analysis, Anthropic does not train on it. We do not transfer it to others except as needed to provide these user-facing features, to comply with applicable law, or as part of a merger or acquisition, and humans do not read it except with your consent, for security purposes such as investigating abuse, or to comply with the law.

SOCIA uses YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy.

Third-party platforms

Your use of Instagram, Facebook, YouTube and TikTok through SOCIA is also governed by those platforms' own terms and privacy policies. SOCIA accesses them only through their official APIs, and only with the permissions you grant on each platform's consent screen.

Children

SOCIA is not directed to children under 13, and we do not knowingly collect information from them. If you believe a child has given us information, email us and we will delete it.

Changes

If this policy changes materially, the date above changes with it and we will note it in the product.

Questions: socia.app2026@gmail.com · Terms of Service