Privacy Policy

Account information

• Email address and password (used and securely hashed by our authentication provider, Supabase).
• Company or venue profile details you provide during onboarding, such as your business name, business type, and primary goal for using the Platform.

Content you provide

• Public social media post URLs you paste into the Platform for analysis.
• Video and image files you upload for analysis, and still frames our system extracts from uploaded video in your browser before upload.
• Performance metrics, captions, and other text you manually enter about your content (e.g., views, likes, engagement figures).
• Draft content you create or save within the Platform for pre-publish review.

AI-generated and derived data

• Analysis scores, creative feedback, and recommendations generated about your content.
• Strategy plans, content ideas, captions, weekly briefs, and other outputs generated at your request.
• Messages you send to the Platform's chat assistant, and the assistant's responses.

Technical and usage information

• Standard web request logs (such as IP address, browser type, and timestamps) collected by our hosting provider for security, performance, and abuse-prevention purposes.
• Basic usage information about which features you interact with, used to operate and improve the Platform.

Cookies and local storage

• A session cookie set by our authentication provider (Supabase) that keeps you signed in. This is strictly necessary for the Platform to function and cannot be disabled while remaining signed in.
• A display theme preference (dark, light, or auto) stored in your browser's local storage — not a cookie, and not used for tracking.
• We do not currently use analytics cookies, advertising cookies, or third-party tracking pixels. If this changes, we will update this Policy and provide notice as described in Section 15.

• Provide the Platform's core functionality — analyzing your content and generating insights, recommendations, briefs, and strategy plans for you.
• Operate, maintain, secure, and improve the Platform, including diagnosing technical problems.
• Communicate with you about your account, respond to support requests, and (where you have not disabled them) send service-related notices.
• Detect, investigate, and prevent fraud, abuse, and violations of our terms.
• Comply with legal obligations.

What we do not do

• We do not sell your personal information.
• We do not share your personal information with third parties for their own advertising or marketing purposes.
• We do not use your content to provide insights, recommendations, or analysis to any other user. Analysis generated from your content is provided solely to you.

How analysis is performed

Uploaded videos and images, extracted video frames, pasted post text, and the metrics you provide are sent to Anthropic's Claude API for analysis. Frame-by-frame creative analysis is performed using Claude's vision capabilities together with our own proprietary prompts and analysis logic — we do not use a separate third-party computer vision service.

AI-generated recommendations, briefs, strategy plans, content ideas, and captions are produced the same way: your content and inputs are sent to the Claude API, which returns generated text that the Platform displays back to you.

Model training

Anthropic's standard Commercial Terms of Service state that Anthropic may not train its models on customer content submitted through the commercial API. Consistent with that commitment, we do not authorize, and are not aware of, your content being used to train Anthropic's models. This statement reflects Anthropic's published terms as of the effective date of this Policy and is subject to change on Anthropic's part; you can review Anthropic's current terms directly at anthropic.com.

We do not use your content to train our own machine learning models.

AI data retention

Per Anthropic's published data retention practices, inputs and outputs sent to the Claude API are automatically deleted within 30 days, except where content is flagged for a Trust & Safety violation (in which case Anthropic may retain it longer for abuse-monitoring and enforcement purposes) or where a different retention period is otherwise required by law.

Within our own systems, the analysis results, briefs, and recommendations generated from your content are retained as described in Section 8 (Data Retention) so that you can view your history over time.

Human review

AI-generated analysis and recommendations are provided as automated output. We do not manually review your individual content or AI outputs except where necessary to investigate a support request, technical issue, or suspected violation of our terms.

Supabase, Inc.

Provides our authentication, database, and file storage infrastructure. Account credentials, venue profile data, content records, and uploaded media files are stored via Supabase, primarily on infrastructure located in the western United States (Northern California). Access to your data is restricted through row-level security policies that ensure your data is only accessible to your own account.

Anthropic, PBC

Provides the Claude API used to analyze content and generate insights, recommendations, and chat responses, as described in Section 5.

Vercel Inc.

Hosts and serves the Platform's web application.

Future service providers

As the Platform grows, we may engage additional service providers — for example, payment processors, email delivery services, or additional infrastructure providers. We will update this Policy to reflect any new categories of service providers that receive personal information, and where required by law, we will provide additional notice.

What we access, and what we do with it

• Instagram: your professional account's ID and username, your published media (captions, permalinks, media type, timestamps, thumbnails) and the insights the API exposes for that media, such as reach and engagement counts.
• TikTok: your account's open ID and display name, and your published videos with their titles, share URLs, cover images and public engagement counts.
• YouTube: your channel ID and title, your uploaded videos, and their view, like and comment counts.
• We use this data solely to generate written analysis, scores and recommendations for you, the connecting user. It is never shown to another user, never sold, never used for advertising, and never used to train any AI model.
• We request the minimum permissions each platform offers for read-only access to your own content. We do not post, comment, like, follow, message, or take any other action on your behalf.
• We do not access, scrape, or store content belonging to competitors or any account you have not connected.

Disconnecting and deleting

• You can disconnect any account at any time from the relevant integration page inside the Platform. Disconnecting deletes the stored access token and stops all further syncing.
• Disconnecting also deletes the posts previously imported from that account, together with their analyses. The Platform warns you how many posts this affects before you confirm. Posts you added yourself are unaffected.
• You can also revoke the Platform's access directly with the platform itself, independently of us. For Google and YouTube, use https://security.google.com/settings/security/permissions. For Meta and Instagram, use your Facebook Settings under Business Integrations. For TikTok, use Settings and privacy, then Security and permissions, then Manage app permissions.

YouTube API Services

The Platform uses YouTube API Services to import your own channel's videos and their public statistics. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service, available at https://www.youtube.com/t/terms.

Google's Privacy Policy, which describes how Google handles data obtained through its APIs, is available at https://policies.google.com/privacy. You can revoke the Platform's access to your YouTube data at any time via the Google security settings page at https://security.google.com/settings/security/permissions.

We store YouTube data only for as long as your account is connected and your account exists. We do not share YouTube data with third parties except the infrastructure and AI providers described elsewhere in this Policy, and we do not use YouTube data for advertising.

Meta Platform Terms

Our use of data obtained from Instagram through the Meta Graph API complies with the Meta Platform Terms and Developer Policies. To request deletion of all data we hold about you, including anything imported from Instagram, see the Data Deletion section of this Policy or use the account deletion control in Settings.

If you cannot access your account

Email admin@socialpromanagement.com from the address associated with your account and ask us to delete it. We will verify the request and complete the deletion within thirty days.

Deleting only imported platform data

If you want to remove data imported from a connected account without closing your account, disconnect the account from its integration page and then delete the imported posts from your content library. Disconnecting alone stops future syncing but keeps your existing history.

• Uploaded media, content records, analyses, briefs, and strategy plans are retained for as long as your account remains active, or until you delete the specific item yourself.
• If you delete your account yourself from Settings, your personal information and content are deleted immediately. If you instead request deletion by emailing admin@socialpromanagement.com (for example, if you can't access your account), we will complete it within 30 days. Either way, deletion is subject to exceptions where retention is required to comply with a legal obligation, resolve a dispute, or enforce our agreements.
• We may retain and use anonymized or aggregated information that cannot reasonably be used to identify you — for example, aggregate benchmarks across many users — after your account is deleted, for product improvement and analytical purposes.
• AI processing data held by Anthropic is retained per Section 5 above.

• Encryption of data in transit using TLS/HTTPS across the Platform.
• Encryption at rest for stored data and files, provided by our database and storage infrastructure.
• Password hashing and secure session-based authentication.
• Row-level security policies that isolate each user's data at the database level.
• Restricted internal access to production systems and data, limited to what is needed to operate and support the Platform.
• Logging and monitoring of our systems to help detect and respond to unusual or unauthorized activity.
• Evaluation of third-party service providers' security practices before relying on them to process information on our behalf.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify affected users and any applicable regulator as required by law.

• Access or export your data — request a copy of the personal information and content associated with your account by emailing admin@socialpromanagement.com. Self-service export is not yet built into the Platform; we will fulfill these requests manually while that feature is in development.
• Correct your information — update your account and profile details at any time from Settings, or contact us for information you cannot edit yourself.
• Delete your account and data — permanently delete your account and all associated content instantly from Settings. If you're unable to access your account, email admin@socialpromanagement.com and we'll complete the deletion within the timeline described in Section 8.
• Withdraw consent or object to processing — where applicable, contact us to discuss limiting how your information is used.

We will verify your identity (typically by confirming the request comes from the email address on your account) before fulfilling any of the above requests, and we will respond within the time required by applicable law.

• The right to know what personal information we have collected about you and how it has been used and disclosed.
• The right to request deletion of your personal information, subject to certain legal exceptions.
• The right to correct inaccurate personal information.
• The right to opt out of the sale or sharing of your personal information. We do not sell or share personal information as defined by the CCPA/CPRA, so no opt-out mechanism is required.
• The right to non-discrimination for exercising any of these rights.

You can exercise these rights by contacting us at admin@socialpromanagement.com. We will not discriminate against you for exercising any of these rights.