Privacy Policy

Account information

• Email address and password (used and securely hashed by our authentication provider, Supabase).
• Company or venue profile details you provide during onboarding, such as your business name, business type, and primary goal for using the Platform.

Content you provide

• Public social media post URLs you paste into the Platform for analysis.
• Video and image files you upload for analysis, and the still frames, audio levels and transcript of speech we derive from them. Frames are taken in your browser or on your phone before upload, or by our media-processing service after it.
• Performance metrics, captions, and other text you manually enter about your content (e.g., views, likes, engagement figures).
• Draft content you create or save within the Platform for pre-publish review, and the clips, music choices, text and voiceovers in videos you make with the Platform's video editor.

Business details you provide

• Your business's website address, and the text we read from that website to understand your business.
• Your brand voice and style preferences, and business results you choose to enter, such as weekly inquiries or booked jobs.
• If you use tracked links: each visit to a link you created is counted with a daily-salted one-way hash of the visitor's IP address and browser, never the address itself, so repeat visits can be told apart without identifying anyone.
• If you request access to the Platform: the name, email address, business and message you send us.

On the iPhone app

• Photo library (only if you allow it): to find the original video for a post you imported, the app compares videos on your phone with your posts. To do that it sends us a fingerprint of each likely video — visual hashes of a few frames, its duration, size, creation date, file name and the phone's identifier for it — not the video itself. We keep those fingerprints with the match result so matching improves; a video file is uploaded only after you confirm a match.
• Camera and microphone (only if you allow them): used when you record a video or voiceover inside the app.
• Notifications (only if you allow them): a push token from Apple, delivered through Expo's push service, so we can tell you when an analysis is ready.
• Videos you add to the video editor stay on your phone wherever possible. Their sound is uploaded for speech transcription; the clips themselves are uploaded only if the video has to be assembled by our provider (Section 6), and the finished video is uploaded when you save it.

AI-generated and derived data

• Analysis scores, creative feedback, and recommendations generated about your content.
• Strategy plans, content ideas, captions, weekly briefs, and other outputs generated at your request.
• Messages you send to the Platform's chat assistant, and the assistant's responses.

Technical and usage information

• Standard web request logs (such as IP address, browser type, and timestamps) collected by our hosting provider for security, performance, and abuse-prevention purposes.
• Basic usage information about which features you interact with, used to operate and improve the Platform.

Cookies and local storage

• A session cookie set by our authentication provider (Supabase) that keeps you signed in. This is strictly necessary for the Platform to function and cannot be disabled while remaining signed in.
• Short-lived security cookies (ten minutes or less) set while you connect a social media account, which protect that sign-in from forgery. They are strictly necessary and are deleted when the connection completes.
• A display theme preference (dark, light, or auto) stored in your browser's local storage — not a cookie, and not used for tracking.
• We do not currently use analytics cookies, advertising cookies, or third-party tracking pixels. If this changes, we will update this Policy and provide notice as described in Section 16.

• Provide the Platform's core functionality — analyzing your content and generating insights, recommendations, briefs, and strategy plans for you.
• Operate, maintain, secure, and improve the Platform, including diagnosing technical problems.
• Communicate with you about your account, respond to support requests, and (where you have not disabled them) send service-related notices.
• Detect, investigate, and prevent fraud, abuse, and violations of our terms.
• Comply with legal obligations.

What we do not do

• We do not sell your personal information.
• We do not share your personal information with third parties for their own advertising or marketing purposes.
• We do not use your content to provide insights, recommendations, or analysis to any other user. Analysis generated from your content is provided solely to you.

How analysis is performed

Uploaded images, extracted video frames, post captions (pasted, or imported from an account you connected), transcripts and the metrics you provide or import are sent to Anthropic's Claude API for analysis. Frame-by-frame creative analysis is performed using Claude's vision capabilities together with our own prompts and analysis logic.

Speech in your videos is transcribed by Deepgram, which receives the video's audio for that purpose only. Audio levels, colour and frame timing are measured by our own media-processing service, which runs on servers rented from Fly.io. When a video made in the Platform's editor cannot be put together on your phone, it is assembled by Shotstack from the clips, music and voiceover you chose.

AI-generated recommendations, briefs, strategy plans, content ideas, and captions are produced the same way: your content and inputs are sent to the Claude API, which returns generated text that the Platform displays back to you.

Model training

Anthropic's standard Commercial Terms of Service state that Anthropic may not train its models on customer content submitted through the commercial API. Consistent with that commitment, we do not authorize, and are not aware of, your content being used to train Anthropic's models. This statement reflects Anthropic's published terms as of the effective date of this Policy and is subject to change on Anthropic's part; you can review Anthropic's current terms directly at anthropic.com.

Every request we send to Deepgram opts out of Deepgram's Model Improvement Program, so your audio is not used to train Deepgram's models.

We do not use your content to train our own machine learning models.

AI data retention

Per Anthropic's published data retention practices, inputs and outputs sent to the Claude API are automatically deleted within 30 days, except where content is flagged for a Trust & Safety violation (in which case Anthropic may retain it longer for abuse-monitoring and enforcement purposes) or where a different retention period is otherwise required by law.

Within our own systems, the analysis results, briefs, and recommendations generated from your content are retained as described in Section 9 (Data Retention) so that you can view your history over time.

Human review

AI-generated analysis and recommendations are provided as automated output. We do not manually review your individual content or AI outputs except where necessary to investigate a support request, technical issue, or suspected violation of our terms.

Supabase, Inc.

Provides our authentication, database, and file storage infrastructure. Account credentials, venue profile data, content records, and uploaded media files are stored via Supabase, primarily on infrastructure located in the western United States (Northern California). Access to your data is restricted through row-level security policies that ensure your data is only accessible to your own account.

Anthropic, PBC

Provides the Claude API used to analyze content and generate insights, recommendations, and chat responses, as described in Section 5.

Vercel Inc.

Hosts and serves the Platform's web application.

Deepgram, Inc.

Transcribes speech in your videos. It receives a short-lived link to the video's audio and returns the transcript, which we store with the post. We opt every request out of Deepgram's model training.

Fly.io, Inc.

Hosts our own media-processing service, which reads your videos and images through short-lived links to measure audio levels, colour and frames. Files are processed in temporary storage and deleted when each job finishes.

Shotstack Pty Ltd

Assembles videos made in the Platform's editor when they cannot be put together on your phone. It receives short-lived links to the clips, music and voiceover in that video and returns the finished file, which we store in your account.

Expo (650 Industries, Inc.) and Apple

Deliver push notifications to the iPhone app if you allow them. They receive your device's push token and the text of the notification.

Functional Software, Inc. (Sentry)

Receives error reports so we can fix problems. Reports are stripped of access tokens, passwords and other credentials before they leave the Platform, and we have switched off its collection of IP addresses and user identifiers.

Resend, Inc.

Delivers the email that tells us about an access request, containing the name, email address, business and message you entered.

Epidemic Sound AB

Provides the music library in the video editor. It receives the words you search for and the tracks you choose, under one account for the whole Platform; it receives none of your content and no information identifying you.

Changes to this list

We will update this list before any new service provider receives personal information, and where required by law, we will provide additional notice.

What we access, and what we do with it

• Instagram: your professional account's ID and username, your published media (captions, permalinks, media type, timestamps, thumbnails) and the insights the API exposes for that media, such as views, reach, saves and shares. Instagram is connected through Facebook Login: we read the list of Facebook Pages you manage only to find the Page your Instagram account is linked to, and we keep that Page's access token to read your Instagram data. When you ask us to analyze an Instagram video, we fetch the video file from Instagram, store it in your account, and derive its frames and transcript as described in Section 5.
• TikTok: your account's open ID and display name, and your published videos with their titles, share URLs, cover images, durations and engagement counts.
• Facebook Pages (open to invited accounts while Meta reviews it): we list the Facebook Pages you manage so you can choose one, and for the Page you choose we keep its ID, name, category and picture, its access token, and its own published photos, videos and Reels with their captions, dates, links, images and the insights Facebook shares, such as views, reactions, comments and shares. We do not read personal profiles, Groups, messages, or posts that visitors leave on your Page. Text-only and link posts are skipped. Switching to a different Page hides the posts imported from the previous one and deletes them after 14 days, as described below.
• YouTube: your channel ID and title, and your uploaded videos — including private and unlisted ones, which only you can see in the Platform — with their titles, descriptions, thumbnail links, durations and view, like and comment counts. If you allow it when connecting, we also read each video's viewer retention from YouTube Analytics — the share of viewers still watching at each point of the video, and YouTube's own comparison with similar videos — and keep it with the post while you stay connected and keep that permission. If you withdraw it, we delete what we read under it. We never download YouTube videos or audio.
• We use this data solely to generate written analysis, scores and recommendations for you, the connecting user. To do that, captions, metrics, YouTube viewer retention (if you allowed it) and (for Instagram videos you choose to analyze) frames and transcripts are sent to the AI and processing providers named in Sections 5 and 6. It is never shown to another user, never sold, never used for advertising, never combined into benchmarks or results for anyone else, and never used to train any AI model.
• While an account is connected, we refresh its posts and their numbers automatically, about once a day and when you open the Platform. About a week after a post goes out we may analyze it automatically, at most ten posts per account each week, and on Mondays we may write your weekly brief and send one notification if you have turned notifications on. Disconnecting stops all of this.
• We request the minimum permissions each platform offers for read-only access to your own content. We do not post, comment, like, follow, message, or take any other action on your behalf.
• We do not access, scrape, or store content belonging to competitors or any account you have not connected.

Disconnecting and deleting

• You can disconnect any account at any time from the relevant integration page inside the Platform. Disconnecting deletes the stored access token and stops all further syncing.
• Disconnecting also deletes the posts previously imported from that account, together with their analyses and the files we stored for them (cover images, video files, frames). The Platform warns you how many posts this affects before you confirm. Posts you added yourself are unaffected.
• If you switch to a different Instagram account or Facebook Page, the posts imported from the previous one are hidden straight away and kept for 14 days in case you switch back. After 14 days they are deleted, together with their analyses and stored files. Disconnecting deletes them at once.
• Disconnecting also asks YouTube, TikTok and Meta to revoke our access. Instagram and Facebook Pages share one Meta permission: disconnecting one while the other stays connected removes only what the disconnected one used. You can also remove SocialPro yourself under Business Integrations in your Facebook settings.
• If you remove SocialPro under Business Integrations, or ask Facebook to delete the data SocialPro holds about you, Facebook tells us and we delete the Instagram and Facebook Page data linked to your Facebook account, as described in Section 8.
• A post you delete on Instagram or TikTok, or make private on TikTok, is hidden here after the next full sync and deleted, with its analysis and stored files, 14 days later. If a large part of an account disappears at once, we check before hiding anything, so a platform error can't remove your history.
• Weekly briefs and strategy plans you generated earlier are kept, and may still mention those posts. You can delete them, or your whole account, at any time.
• You can also revoke the Platform's access directly with the platform itself, independently of us. For Google and YouTube, use https://security.google.com/settings/security/permissions. For Meta and Instagram, use your Facebook Settings under Business Integrations. For TikTok, use Settings and privacy, then Security and permissions, then Manage app permissions.

YouTube API Services

The Platform uses YouTube API Services to import your own channel's videos (including private and unlisted ones) and their statistics and, if you allow it, each video's viewer retention from YouTube Analytics. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service, available at https://www.youtube.com/t/terms.

Google's Privacy Policy, which describes how Google handles data obtained through its APIs, is available at https://policies.google.com/privacy. You can revoke the Platform's access to your YouTube data at any time via the Google security settings page at https://security.google.com/settings/security/permissions.

We store YouTube data only while your YouTube account is connected. At least every 30 days we check that we are still authorized and refresh the stored titles, descriptions and statistics, or delete what YouTube no longer returns; if we cannot confirm our authorization for 30 days, we delete your YouTube data. Viewer retention is read again when you open or analyze a video and the stored reading is more than 7 days old, is kept only while you keep the permission that allows it, and is deleted with the post. If you revoke our access in Google's settings, we delete your YouTube data within 30 days; if you disconnect inside the Platform or ask us to delete it, we delete it within 7 days. Thumbnails are shown from YouTube's own servers, not copied.

YouTube data is shared only with the providers named in Sections 5 and 6, for the analysis described there. Descriptions, statistics and, if you allowed it, viewer retention are sent to Anthropic's Claude API to produce your analysis. We do not use YouTube data for advertising.

SocialPro's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Meta Platform Terms

Our use of data obtained from Instagram and Facebook Pages through the Meta Graph API complies with the Meta Platform Terms and Developer Policies. To request deletion of all data we hold about you, including anything imported from Instagram, see the Data Deletion section of this Policy or use the account deletion control in Settings.

If you cannot access your account

Email admin@socialpromanagement.com from the address associated with your account and ask us to delete it. We will verify the request and complete the deletion within seven days.

Through Facebook

If you remove SocialPro under Business Integrations in your Facebook settings, or ask Facebook to delete the data SocialPro holds about you, Facebook tells us which Facebook account it is and we delete the Instagram and Facebook Page connections linked to it, with their imported posts, analyses and stored files. For a deletion request, Facebook gives you a confirmation code and a link where you can see what we did. If nothing was linked to that Facebook account — for example because it was connected before we began recording it — the status page says so; email admin@socialpromanagement.com and we will delete it by hand within seven days.

Deleting only imported platform data

If you want to remove data imported from a connected account without closing your account, disconnect the account from its integration page. Disconnecting deletes the imported posts, their analyses and their stored files, as described in Section 7.

• Content records, analyses, still frames, briefs, and strategy plans are retained for as long as your account remains active, or until you delete the specific item yourself.
• Video files may be deleted automatically 30 days after upload once they have been analyzed; the analysis and still frames are kept. A video in an unpublished draft, or a clip still used in a video you are editing, is kept.
• Data imported from YouTube follows the 30-day refresh and deletion rules in Section 7. YouTube viewer retention is kept with its post only while you keep the permission that allows it.
• If you delete your account yourself from Settings, your personal information and content are deleted immediately. If you instead request deletion by emailing admin@socialpromanagement.com (for example, if you can't access your account), we will complete it within 7 days. Either way, deletion is subject to exceptions where retention is required to comply with a legal obligation, resolve a dispute, or enforce our agreements.
• We may retain and use anonymized or aggregated information that cannot reasonably be used to identify you after your account is deleted, for product improvement and analytical purposes. This never includes data imported from a connected social media account.
• AI processing data held by Anthropic is retained per Section 5 above.

• Encryption of data in transit using TLS/HTTPS across the Platform.
• Encryption at rest for stored data and files, provided by our database and storage infrastructure, and an additional layer of encryption (AES-256) for connected-account access tokens, with the key held outside the database.
• Password hashing and secure session-based authentication.
• Row-level security policies that isolate each user's data at the database level.
• Restricted internal access to production systems and data, limited to what is needed to operate and support the Platform.
• Logging and monitoring of our systems to help detect and respond to unusual or unauthorized activity.
• Evaluation of third-party service providers' security practices before relying on them to process information on our behalf.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify affected users and any applicable regulator as required by law.

• Access or export your data — request a copy of the personal information and content associated with your account by emailing admin@socialpromanagement.com. Self-service export is not yet built into the Platform; we will fulfill these requests manually while that feature is in development.
• Correct your information — update your account and profile details at any time from Settings, or contact us for information you cannot edit yourself.
• Delete your account and data — permanently delete your account and all associated content instantly from Settings. If you're unable to access your account, email admin@socialpromanagement.com and we'll complete the deletion within the timeline described in Section 8.
• Withdraw consent or object to processing — where applicable, contact us to discuss limiting how your information is used.

We will verify your identity (typically by confirming the request comes from the email address on your account) before fulfilling any of the above requests, and we will respond within the time required by applicable law.

• The right to know what personal information we have collected about you and how it has been used and disclosed.
• The right to request deletion of your personal information, subject to certain legal exceptions.
• The right to correct inaccurate personal information.
• The right to opt out of the sale or sharing of your personal information. We do not sell or share personal information as defined by the CCPA/CPRA, so no opt-out mechanism is required.
• The right to non-discrimination for exercising any of these rights.

You can exercise these rights by contacting us at admin@socialpromanagement.com. We will not discriminate against you for exercising any of these rights.