Privacy Policy

1. Information We Collect

We collect the following types of information when you use the Service:

• check_circleAccount information: your name, email address, username, company name, timezone, and preferred language.
• check_circleContent you create: the posts, captions, images, videos, and schedules you create in the Service.
• check_circleConnected social account data: described in detail in the next section.
• check_circleMedia you import: images you bring in from Google Photos, Google Drive, Dropbox or Unsplash — only the files you pick yourself. See "Importing Media From Other Services" below.
• check_circleUsage data: how you interact with the Service, such as features used, pages visited, device and browser type, and IP address.
• check_circleAI content: your workspace's brand voice (name, tone, audience, preferred words, example posts), the workspace's Rules (short instructions you write for the AI, such as words or topics to avoid), the results of AI rule checks, the AI images you create, and the files, text and web pages you add to the Knowledge Base. See "AI Features" below.
• check_circleBilling data: your plan, invoices and payment status, and what you enter at checkout — the country you are billed in (and your state, if you are in India), your GSTIN if you give one, a billing email address if you want invoices sent somewhere other than your account email, and your mobile number. The country, state and GSTIN appear on your invoices so they state the right tax. The billing email and mobile number are passed to our payment provider, Razorpay, so its payment window is filled in for you. Card, UPI and bank details are collected and processed directly by Razorpay — we never see or store your full card details.

2. Data From Connected Social Accounts

When you choose to connect a social account, the platform asks for your consent and then shares limited data with us through its official API. We collect only what is needed to publish content on your behalf and show you your own analytics. Per platform:

• check_circleFacebook, Instagram & Threads (Meta): your public profile (name, ID, profile picture), the list of Pages and professional accounts you manage, an access token, the IDs of posts we publish for you, and engagement metrics (likes, comments, reach) for those posts. Our access is governed by the Meta Platform Terms.
• check_circleLinkedIn: your name, LinkedIn member ID, email address, profile picture, the organisation pages you administer, an access token, and the IDs of posts we publish for you. We do not collect LinkedIn engagement analytics. We do not sell LinkedIn data, use it for advertising, or share it with any third party — it is used only to provide the features you request.
• check_circleYouTube (Google): your channel name, channel ID, profile picture, upload status, an access token, and metadata of the videos you upload through the Service.
• check_circlePinterest: your Pinterest username and account type, an access token and a refresh token, the names and IDs of your own boards and board sections, the IDs of pins we publish for you, the performance numbers Pinterest reports for those pins (impressions, saves, clicks, reactions, comments), and your follower count. Described in full in the Pinterest section below.
• check_circleMastodon: your username, your account ID, the address of the Mastodon server you are on, an access token, the IDs of posts we publish for you, and the public engagement counts on those posts (favourites, boosts, replies).
• check_circleBluesky: your handle and account DID, session tokens issued in exchange for the app password you provide, whether your Bluesky email is confirmed (Bluesky refuses video uploads from unconfirmed accounts, so we warn you before you schedule one), the IDs of posts we publish for you, and the public engagement counts on those posts (likes, reposts, replies).
• check_circleReddit: your Reddit username and account ID, an access token and a refresh token, the flair options offered by the subreddit you are posting to, and the ID and permalink of each submission we create for you. We request only the identity, submit and flair scopes — we hold no read scope, so we cannot browse, search or collect any Reddit content. Described in full in the Reddit section below.
• check_circleGoogle Business Profile: your business account name and resource ID, an access token and a refresh token, and the IDs of posts we publish for you.
• check_circleX: your X account ID, username and display name, an access token and a refresh token, and the ID of each post we publish for you. To publish, we send X the text and any images or videos of the posts you choose to send there. We read nothing else from X, keep only the post ID from X's reply, never sell or share X data, and never use it to train AI models. Because X does not allow the same or a nearly identical post twice, we keep a one-way fingerprint of each post's words (never the text itself) for 60 days after it is sent to X, even if you delete the post from Social Publish AI, so the same text is not sent again by mistake.
• check_circleTikTok: your public profile (handle or display name and account ID) and an access and refresh token. This integration is not yet available to users; this entry describes what we will collect once it is enabled.

3. Google & YouTube API Services

The Service uses YouTube API Services to connect your YouTube channel and upload videos. By connecting a YouTube account you agree to the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.

Social Publish AI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the publishing and analytics features you request — never for advertising, and we never sell it or transfer it to third parties except as necessary to provide those features, for security, or to comply with the law.

In addition to disconnecting your YouTube account inside the Service, you can revoke our access at any time from your Google security settings page.

4. LinkedIn API Services

The Service uses the LinkedIn APIs to sign you in and to publish content to your LinkedIn account. Signing in with LinkedIn shares your name, profile picture, and email address with us; the publishing permission lets us post content to LinkedIn only when you instruct us to. Our access is governed by the LinkedIn API Terms of Use and the LinkedIn Developer Program policies, and LinkedIn's own handling of your data is described in the LinkedIn Privacy Policy.

We use LinkedIn member data only to provide the publishing features you request. The Service does not currently collect or display LinkedIn analytics. We never sell LinkedIn data, never use it for advertising or to train AI models, and never share it with third parties except as needed to provide those features, for security, or to comply with the law.

In addition to disconnecting your LinkedIn account inside the Service, you can revoke our access at any time from your LinkedIn permitted services settings.

Social Publish AI is an independent third-party application. We are not affiliated with, endorsed by, sponsored by, or officially partnered with LinkedIn Corporation, and "LinkedIn" is a trademark of LinkedIn Corporation used here only to identify the platform we integrate with.

5. Pinterest API Services

The Service uses the Pinterest API to publish pins to your Pinterest account. Connecting a Pinterest account gives us permission to read your own boards, read and create your own pins, and read your basic account details. Our access is governed by the Pinterest Developer & API Terms, and Pinterest's own handling of your data is described in the Pinterest Privacy Policy.

We read the list of your own boards and board sections for a single purpose: so you can choose a destination board from a list when composing a pin, instead of having to find and type a numeric board ID. We do not read other Pinners' boards or pins, we do not browse, save or analyse content you did not create through the Service, and we do not build any profile or recommendation model from Pinterest data.

We store your Pinterest username, your account type, an access token and a refresh token, and the ID of each pin we publish for you. The refresh token is used only to keep your connection alive so scheduled pins can publish without you reconnecting every month.

For the pins we publish for you, we read the performance numbers Pinterest reports (impressions, saves, pin and outbound clicks, reactions and comments), and we read your account's follower count once a day. They are shown only to you and your workspace, on the Analytics page. We do not read numbers for pins you did not publish through the Service.

We use Pinterest data only to provide the publishing and analytics features you request. We never sell it, never use it for advertising or to train AI models, and never share it with third parties except as needed to provide those features, for security, or to comply with the law.

In addition to disconnecting your Pinterest account inside the Service, you can revoke our access at any time from Pinterest itself: Settings → Security → Apps, where you can remove Social Publish AI.

6. Reddit Data API

The Service uses the Reddit Data API to submit posts to Reddit on your behalf. Our access is governed by the Reddit Responsible Builder Policy, the Reddit Developer Terms and the Reddit Data API Terms. Reddit's own handling of your data is described in the Reddit Privacy Policy.

Connecting a Reddit account grants us three permissions and no more: identity (to show you which account you connected), submit (to create your post), and flair (to read the flair choices a subreddit offers, so your post is not auto-removed for missing one). We hold no read permission of any kind — we cannot and do not read your feed, your history, your messages, your saved items, or anyone else's posts and comments.

We store your Reddit username and account ID, an access token and a refresh token, and the ID and permalink of each submission we create for you. The refresh token exists only so a post you scheduled for a future time can still be published without you having to reconnect.

Every submission is made with your own account, under your own username, using your own authorisation. We do not operate a bot account, and nothing is ever posted without an action you took in the Service. We do not vote, comment, send messages, follow, or run any form of engagement automation. One post targets exactly one subreddit, and the Service does not cross-post the same content to multiple subreddits.

We never sell Reddit data, never share it with any third party, never use it for advertising, and never use it to train or fine-tune any AI or machine-learning model. Reddit content is not scraped, not bulk-collected, and not retained beyond the identifiers listed above. The AI features in the Service operate only on text you write yourself, never on content taken from Reddit.

You can disconnect your Reddit account inside the Service at any time, which deletes the stored tokens and account details immediately. You can also revoke our access directly from Reddit itself: Settings → Safety & Privacy → Manage third-party app authorization.

Social Publish AI is an independent third-party application. We are not affiliated with, endorsed by, sponsored by, or officially partnered with Reddit, Inc., and "Reddit" is a trademark of Reddit, Inc. used here only to identify the platform we integrate with.

7. Importing Media From Other Services

Besides uploading files from your device, the Service lets you bring images in from a few storage and stock-photo services. In every case you pick the files yourself in that service's own picker, and only the files you pick ever reach us — we never browse, list or scan the rest of your library.

• check_circleGoogle Photos: connecting Google Photos is a separate Google consent from signing in, and it grants only the photospicker.mediaitems.readonly scope. We store an access token for the connection so you do not have to reconnect each time, plus the photos you select. This connection is covered by the Google API Services User Data Policy described above, including its Limited Use requirements. You can disconnect it in the Service, or revoke it from your Google account permissions page.
• check_circleGoogle Drive: uses the Google Picker inside your browser. The access token stays in your browser for that one picker session and is never sent to or stored on our servers — we receive only the images you choose.
• check_circleDropbox: uses the Dropbox Chooser inside your browser. We receive only a temporary link to each file you choose, which we use once to fetch the image. We never receive or store your Dropbox credentials or a Dropbox access token.
• check_circleUnsplash: stock photo search runs through our own Unsplash application key. No Unsplash account of yours is involved, and no personal data about you is sent to Unsplash.

8. AI Features

The Service includes optional AI features: writing captions, suggesting hashtags, creating images, improving image descriptions, repurposing posts, a chat assistant, an AI agent that drafts posts for you, and a Knowledge Base of files, text and web pages the AI can write from. Our AI providers are OpenAI, Anthropic (Claude) and Google (Gemini), through their APIs. In the chat assistant you pick a model, or choose Auto and we pick one for each message; the provider of that model answers.

When you use an AI feature, what that feature needs is sent to the provider of the model that does the work (OpenAI, Anthropic or Google), which processes it and returns a result: your request (for example the brief for a caption, or the description of an image), the post you are working on, your workspace's brand voice and Rules and, when the Knowledge Base is on, the passages from it that match the request. Images are drawn by OpenAI from the description you give.

When a post is checked against your Rules (when you click Check rules, before a post is published, and before an AI agent's draft is used), the post text and your Rules are sent to OpenAI, which says whether any rule is broken. We store the result (which rules were broken with a copy of their wording, the version of your Rules, and a one-way fingerprint of the post text, never the text itself) for 30 days so the same text is not checked twice, and then delete it automatically.

Files, text and website pages you add to the Knowledge Base are split into passages, and each passage is sent to OpenAI once to build a search index, which we store. When you add a website, we fetch its public pages ourselves.

AI processing happens when you use an AI feature, and when an AI agent you switched on writes posts on the schedule you set. We do not send the posts, comments or profiles we read from your connected social accounts to our AI providers. To tune later suggestions for your workspace, an AI request may include two things we work out on our own servers: your posts' average engagement rate, and examples of drafts the AI wrote next to the version you published.

Under OpenAI's API terms, data sent through its API is not used to train its models, and OpenAI keeps it for up to 30 days for abuse monitoring unless the law requires longer (OpenAI: Your data). Under their API terms, Anthropic (Anthropic Privacy Center) and Google, for the paid Gemini API (Gemini API terms), also do not use data sent through their APIs to train their models. Neither we nor our AI providers use your content to train AI models, and AI output is returned to you and your workspace only.

9. Our Independence From Connected Platforms

Social Publish AI is an independent service. We are not affiliated with, endorsed by, sponsored by, or officially partnered with LinkedIn Corporation, Meta Platforms, Google/YouTube, X Corp., TikTok, Pinterest, or any other platform we integrate with. All platform names and logos are trademarks of their respective owners and are used only to identify the services you can connect.

10. How We Use Your Information

We use your information to:

• check_circleProvide, operate, and maintain the Service.
• check_circlePublish and schedule your content to the social networks you connect, as you instruct.
• check_circleShow you analytics about your own published content and audience, for the platforms that make those figures available.
• check_circleGenerate AI suggestions — captions, hashtags, images, repurposed copy and agent drafts — when you ask for them or switch them on.
• check_circleProcess payments and manage your subscription.
• check_circleCommunicate with you about your account, updates, and support requests.
• check_circleKeep the Service secure, and prevent fraud or abuse.

11. Legal Basis for Processing

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR:

• check_circlePerformance of a contract: running your account, publishing and scheduling your content, showing your analytics, providing the AI features you use, and managing your subscription.
• check_circleConsent: connecting a social account or a media source, analytics cookies on our public pages, and optional marketing emails. You can withdraw consent at any time, as described under "Your Rights".
• check_circleLegitimate interests: keeping the Service secure, preventing fraud and abuse, and improving the Service. We do this only where those interests are not overridden by your rights.
• check_circleLegitimate interests — proof of what was agreed: keeping a record of when you accepted our Terms of Service, Privacy Policy or AI-Generated Content Terms — your account, the document version, the date and time, and your IP address — so we can show what was agreed.
• check_circleLegal obligation: keeping invoices and accounting records, and responding to lawful requests from authorities.

12. How We Share Information

We do not sell your personal information, and we do not share data obtained from connected social platforms with advertisers, data brokers, or AI-model training. We share information only in these limited situations:

• check_circleWith the social networks you connect, to publish your content as you instruct.
• check_circleWith service providers who help us run the Service — server hosting (Hetzner), file storage (Cloudflare R2), AI processing for the AI features you use (OpenAI, Anthropic, Google), payment processing (Razorpay), and email delivery (Zoho ZeptoMail) — under contracts that limit what they can do with it.
• check_circleWith members of your own workspace, according to the roles you assign them.
• check_circleWhen required by law, or to protect the rights, safety, and security of our users and the Service.
• check_circleAs part of a merger or acquisition, in which case this policy continues to apply and you will be notified.

13. We Do Not Sell or Share Your Personal Information

We do not sell your personal information, and we do not "share" it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act as amended by the CPRA. We have not done so in the past 12 months. Because we do neither, there is nothing to opt out of — but you can still contact us with any privacy request, and we will not discriminate against you for exercising your rights.

We do not use or disclose sensitive personal information for any purpose other than providing the Service.

14. How We Protect Your Data

We protect your data with industry-standard measures, listed below. No method of storing or transmitting data over the internet is completely secure, so while we work hard to protect your data, we cannot guarantee its absolute security.

• check_circleSocial account access tokens are held on access-restricted servers and are never exposed in the browser, logs, or API responses.
• check_circleAll traffic between your browser, our servers, and social platforms uses TLS (HTTPS).
• check_circleAccess to production systems is restricted, access-controlled, and logged.
• check_circlePasswords are stored only as salted one-way hashes.
• check_circleIf a personal-data breach occurs, we notify the relevant data-protection authorities within the time the law requires (72 hours under the GDPR), and we notify affected users without undue delay, telling them what happened, what data was involved, and what we are doing about it.

15. Data Retention & Deletion

We keep your information only for as long as your account is active or as needed to provide the Service. Step-by-step instructions are on our Data Deletion Instructions page.

• check_circleDisconnecting a social account (Accounts page → Disconnect) immediately deletes the stored access and refresh tokens and stops all further data collection from that platform. The analytics we collected for that account (post results and follower history) are kept for 7 days, so reconnecting it keeps your history, and are then deleted; the Accounts page shows the date. You can also revoke access from the platform's own settings (e.g. Facebook "Business integrations", Google security settings, LinkedIn "Permitted services", Pinterest "Apps").
• check_circleA connection that stops working — for example because you revoked our access in the settings of the platform itself — and is not reconnected has its analytics deleted within 21 days of the platform refusing our access.
• check_circleDeleting your account closes your login straight away. In every workspace you created it cancels scheduled posts, disconnects every social account and deletes its tokens, and deletes the Knowledge Base, AI chats, brand voice, Rules and AI images (stored AI rule-check results are deleted automatically within 30 days); the analytics of those accounts are deleted 7 days later. Published posts and drafts are not deleted automatically — ask us by email (below) and we erase them within 30 days. We keep limited records only where the law requires it, such as invoices.
• check_circleRecords of acceptance (your account, the document version, the date and time, and your IP address) are kept while your account exists and for 5 years after it is deleted, as evidence of the agreement, and are then deleted automatically.
• check_circleDeletion on request: you can also request deletion of your data at any time by emailing [email protected]; we will complete the deletion within 30 days and confirm to you.

16. Your Rights

Depending on where you live — for example under the GDPR in the European Union and the United Kingdom, the CCPA/CPRA in California, or India's DPDP Act — you may have the right to:

• check_circleAccess the personal information we hold about you.
• check_circleCorrect inaccurate information.
• check_circleRequest deletion of your personal information.
• check_circleObject to or restrict certain processing, and withdraw consent where processing is based on consent.
• check_circleExport your data in a portable format.
• check_circleComplain to your local data-protection authority.
• check_circleWithdraw consent as easily as you gave it: change your analytics choice with the Cookie settings link in the footer, disconnect any social account or media source on the Accounts page, or delete your account in Settings. Withdrawing consent does not affect processing that already happened.
• check_circleExercise any of these rights by using "Export my data" or "Delete Account" in Settings, or by emailing [email protected]. We answer within 30 days.

17. Cookies & Tracking

We use essential cookies and local storage to keep you signed in and to remember preferences such as language and theme. These are needed for the Service to work and are always on.

On our public pages (home, pricing, guides, contact, legal pages and similar) we use Google Analytics to count visits and understand which pages are useful. It sets analytics cookies only if you choose Accept in the cookie banner; if you choose Decline, no analytics cookies are set and Google receives only a cookieless signal without identifiers. We send Google the page path, never the rest of the address. Google Analytics never runs inside your logged-in workspace, on sign-in, email-verification and password-reset links, or on link-in-bio pages. You can change your choice at any time with the Cookie settings link in the footer. Google's use of this data is described at How Google uses information from sites that use its services.

We do not use advertising cookies. You can also block or delete cookies through your browser settings.

18. International Data Transfers

Our servers are hosted by Hetzner in Germany, inside the European Union. Some of our service providers process data in other countries: OpenAI, Anthropic and Google (AI features) and Cloudflare (file storage) may process data in the United States, Zoho ZeptoMail (email delivery) may process data outside your country, and Razorpay (payments) processes data in India.

Where personal data from the European Economic Area or the United Kingdom is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) in our agreements with those providers, or on the provider's certification under the EU-U.S. Data Privacy Framework where available. You can ask us for a copy of the relevant safeguards at [email protected].

19. Children's Privacy

The Service is not intended for children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us and we will delete it.

20. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the Service or by email before they take effect. The "Last updated" date at the top shows when the policy was last revised.

21. Contact Us

Social Publish AI is a sole proprietorship owned by Akash Mohite, registered address: Mohite Wasti, Kalamb, Walchandnagar, Pune, Maharashtra 413114, India. It is the business responsible for your personal data under this Privacy Policy.

If you have questions about this Privacy Policy or how we handle your data, contact us at [email protected]. We respond to privacy requests within 30 days.

Grievance Officer: Akash Mohite, [email protected], +91 87667 60700. Complaints are acknowledged within 48 hours and resolved within one month. Full contact details are on our Contact page.