Soocialy Privacy Policy

1. Data controller

The data controller is naSpotted sp. z o.o., al. Jana Pawła II 43A/37B, 01-001 Warszawa, Poland, registered in the Polish National Court Register (KRS) under number 0001255909, tax ID (NIP) 5273228667 ("we").

Contact for all data matters: contact@soocialy.com. We reply within two business days.

2. Data we collect

• Account: email address, password (stored only as a cryptographic hash), name or display name, role in a brand (owner, manager, team member).
• Brand: name, website, city, description of your offer and services, prices, goals, brand profile and settings that you enter or that we prepare from an analysis of your website.
• Content: plans, posts, captions, comments, photos and videos that you add or that we create at your request. Photos may show people - in that case we also store the confirmation of consent to use their image.
• Connected accounts: when you connect Instagram, Facebook, TikTok, Google or LinkedIn - the account ID and name, access keys (tokens), their expiry dates and granted scopes, statistics of published posts, and comments and messages if you turn on the inbox.
• Notifications: the email address for notifications and your Telegram chat ID if you connect it.
• Payments: invoice details and order history. We never see or store card data - Stripe handles it.
• API keys: when you create a key for adding content from other systems, we store only its cryptographic hash, name and date of last use.
• Technical data: error logs, records of actions in the app (e.g. "content generated"), IP address only in hashed form (for rate limits and click statistics), and the cookies described in section 10.
• Free website audit (no account): the address of the analysed website, your email address if you provide it, and a hash of your IP address for the audit limit.

3. Why we process data and on what legal basis

• Providing the service - your account, creating and scheduling content, publishing to connected accounts, notifications, support (Art. 6(1)(b) GDPR - contract).
• Payments, invoices and accounting (Art. 6(1)(c) GDPR - legal obligation).
• Security, abuse prevention, rate limits, fixing errors and improving the app, usage statistics, legal claims and replying to messages (Art. 6(1)(f) GDPR - our legitimate interest).
• The free audit and replying to a question left with an email address (Art. 6(1)(f) GDPR, and Art. 6(1)(b) GDPR when you ask us to contact you).

We do not sell data and do not use it for other companies' advertising. We do not make decisions about you based solely on automated processing that would have legal effects. You can always edit or reject content suggested by AI.

4. Data of your brand's customers

If you enter your customers' data into Soocialy (e.g. contacts and marketing consents, messages and comments from your profiles, review requests), you are the controller of that data and we process it only on your behalf and on your instructions - the data processing agreement is part of the Terms of Service.

Ad landing pages and booking links created for your brand may use your Meta pixel and count clicks. You decide about the pixel and you inform your customers about it.

5. TikTok

Connecting TikTok is optional. You log in on TikTok's own page (TikTok Login Kit) and decide whether to grant Soocialy access. We request only these scopes:

• user.info.basic - account ID (open_id), username, display name and avatar, so we can show you which account a post will go to;
• video.upload and video.publish - to publish on your account the posts you approve.

What we store: the account ID (open_id), username and display name, and the access keys (access token and refresh token) with their expiry date and granted scopes. Keys are stored encrypted (AES-256-GCM). We do not store your avatar and we do not read or store your videos or followers.

Why: only to publish the posts you approve. Before every post we show a consent screen: a preview of the post, the target account, an editable title and description, the choice of who can view the post (no default value), comment, duet and stitch settings, and commercial content disclosure. Nothing is published without your click on that screen - even with autopilot turned on. We never add watermarks or the Soocialy logo to your content.

What we send to TikTok: the post's photos or video, title, description and the settings you chose on the consent screen. TikTok downloads the files from our server through a signed link that expires after 6 hours. After publishing we store the post ID and link to show you its status.

How to disconnect: in Soocialy go to Connections and click "Disconnect TikTok" - we revoke the keys at TikTok and delete them on our side. You can also remove access in the TikTok app: Profile → Menu → Settings and privacy → Security and permissions → Apps and services. Deleting your Soocialy account also deletes the stored keys.

TikTok processes data under its own privacy policy: https://www.tiktok.com/legal/privacy-policy-eea. By posting you also accept TikTok's rules, including the Music Usage Confirmation (https://www.tiktok.com/legal/page/global/music-usage-confirmation/en) and - for branded content - the Branded Content Policy (https://www.tiktok.com/legal/page/global/bc-policy/en).

6. Who we share data with

We entrust data only to companies that help us provide the service, and only to the extent needed:

• Supabase Inc. - database, login and file storage (servers in the European Union, Frankfurt);
• Hetzner Online GmbH - application server (Germany);
• Anthropic PBC and Google (Gemini) - AI models that draft content suggestions and describe photos; we send only what a given task needs;
• Brevo (Sendinblue SAS, France) - emails sent by the app;
• Stripe - payment processing;
• Telegram - notifications, if you connect a chat;
• SMSAPI (LINK Mobility Poland) and Brevo - SMS and email campaigns to your customers, if you turn them on;
• the provider fulfilling promotional service orders ("Boost reach") - receives only the link to the profile or post the order concerns;
• our accounting office - for accounting documents.

Platforms you connect (Meta, Google, TikTok, LinkedIn) are separate controllers and process data under their own terms. We may also disclose data to public authorities where the law requires it.

7. Transfers outside the European Economic Area

Some providers (e.g. Anthropic, Google, Stripe, Telegram) may process data outside the EEA, in particular in the USA. Such transfers rely on the European Commission's adequacy decision (EU-US Data Privacy Framework) or on standard contractual clauses approved by the Commission. On request, we will tell you which safeguards apply.

8. How long we keep data

• Account, brand and content data - until you delete the account or the brand. Database backups are deleted automatically after 14 days.
• Access keys to connected accounts (including TikTok) - until you disconnect the account or delete your Soocialy account.
• File links for TikTok - expire after 6 hours.
• Accounting documents - 5 years from the end of the year in which they were issued (legal obligation).
• Free audit - up to 12 months after it was run, or less if you ask us to delete it.
• Technical logs - as long as needed to keep the service secure and fix errors.

9. Your rights

You have the right to access, rectify and erase your data, to restrict processing, to data portability and to object to processing based on our legitimate interest. Where processing is based on consent, you can withdraw it at any time.

You can delete your account yourself in the app (Settings → Delete account) - instructions: https://app.soocialy.com/en/delete-account. For anything else, write to contact@soocialy.com.

You also have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa, https://uodo.gov.pl), or with the supervisory authority in your country.

10. Cookies

The app uses only strictly necessary cookies: the login session (keeps you signed in) and the selected brand (remembers which brand you are working on). We do not use analytics or advertising cookies in the app. You can delete cookies in your browser - you will then need to sign in again.

11. Security

Connections are encrypted (HTTPS). Passwords are stored as hashes, TikTok access keys are encrypted and API keys are stored as hashes. Each brand's data is isolated from other brands at the database level. Only the team that runs the service has access to the data.

12. Changes to this policy

We will announce material changes in the app or by email before they take effect. The current version is always available at this address, with its effective date at the top of the page.