Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

Account Information: When you create an account, we collect:

• Email address
• Password (encrypted)
• Name (if provided)
• Profile information you choose to add

Payment Information: When you subscribe to our Services, we collect:

• Billing name and address
• Payment method details (credit card, debit card)

Note: Payment information is processed and stored by our payment processor, Stripe. We do not store complete credit card numbers on our servers. We only retain the last four digits of your card, card type, and expiration date for reference purposes.

Communication Information: When you contact us, we collect:

• Email correspondence
• Support ticket content
• Feedback and survey responses

User Content: When you use our Services, we collect:

• Content you input into our AI-powered tools
• Posts you draft, schedule and publish, including captions, hashtags, links and publishing settings
• Files you upload
• Outputs generated through the Services
• Usage preferences and settings

1.2 Information from Third-Party Authentication Providers

We offer the ability to register and sign in using third-party authentication services. When you choose to authenticate through these services, we receive certain information from them as described below.

Social Login and Authentication Providers:

• Google (Google Sign-In)
• Apple (Sign in with Apple)
• Facebook (Facebook Login)
• LinkedIn (LinkedIn Sign-In)
• X (formerly Twitter)
• Phone Number / SMS Authentication
• WhatsApp Authentication

Information Received from Authentication Providers:

When you authenticate using a third-party provider, we may receive the following information depending on the provider and your privacy settings with that provider:

Important Notes About Third-Party Authentication:

• The information we receive is determined by the third-party provider and your privacy settings with that provider
• We do not control what information these providers share with us
• We do not receive or store your passwords for these third-party services
• Your relationship with these providers is governed by their respective privacy policies and terms of service
• You can manage the information shared with us through your privacy settings on each provider's platform
• Revoking our access through the provider's settings may affect your ability to sign in to our Services

Third-Party Provider Privacy Policies:

We encourage you to review the privacy policies of any authentication providers you use:

• Google
• Apple
• Microsoft
• Facebook/Meta
• LinkedIn
• X (Twitter)
• WhatsApp

1.3 Information Collected Automatically

Usage Data: We automatically collect information about your interaction with our Services, including:

• Features used and actions taken
• Date and time of access
• Duration of sessions
• Error logs and performance data

Device and Technical Information:

• IP address
• Browser type and version
• Operating system
• Device type and identifiers
• Screen resolution
• Language preferences

Authentication and Security Data:

• Login timestamps and frequency
• Authentication method used
• Session identifiers
• Security events (failed logins, password resets)
• Device fingerprints for fraud prevention

Cookies and Similar Technologies: We use cookies, pixels, and similar tracking technologies to collect information. See Section 9 and our Cookie Policy for more details.

1.4 Information from Connected Social Media Accounts

When you connect a social media account so that Social9 can publish for you, we receive access tokens and limited account information from that platform. Section 2 lists exactly what we receive from each platform, what we do with it and how long we keep it.

1.5 Information from Third-Party Services

We may receive information about you from:

• Payment processors (transaction confirmations, fraud alerts)
• Analytics providers
• Third-party authentication services (as described in Section 1.2)
• Identity verification services (if applicable)
• Fraud prevention services

2. Connected Social Media Accounts

Social9 is a social media content creation and scheduling service. You can connect your social media accounts to Social9 so that it can publish the posts you create, at the time you choose. This section explains, for each platform, what we access, what we store, how long we keep it, and how you remove it. It applies in addition to the rest of this Privacy Policy.

2.1 How Connecting Works

• You connect an account from Channels in the Social9 app at app.social9.com. You are sent to the platform's own sign-in and consent screen, where the platform shows you the permissions Social9 is asking for.
• We use each platform's official OAuth authorization. We never see or store your social media passwords. The platform gives us an access token (and, where the platform issues one, a refresh token) that lets Social9 act only within the permissions you approved.
• Social9 only publishes content that you, or a member of your Social9 workspace with permission to do so, created or approved and scheduled. We do not post, like, follow, comment or message on your behalf automatically.
• You can disconnect any account at any time, in Social9 or on the platform itself (see section 2.5).

2.2 What We Access and Do, by Platform

We request only the permissions needed for the features below.

2.3 What We Store

Deleted data may remain in encrypted backups for up to 35 days before the backups are overwritten. Backups are not used to restore data you deleted.

2.4 What We Never Do

• Sell data obtained from social media platforms, or share it with data brokers
• Use it for advertising, ad targeting or retargeting
• Use it to train general-purpose AI models
• Read your direct messages
• Publish anything you did not create or approve
• Let anyone outside your Social9 workspace see your connected accounts or their data
• Let our staff view data from your connected accounts, except with your permission (for example, when you ask support to investigate a failed post), for security reasons, or where the law requires it

2.5 How to Disconnect and Delete

• Disconnect one account: in the Social9 app, go to Channels → select the account → Disconnect. We revoke the token with the platform where it supports revocation, cancel that account's scheduled posts, and delete its tokens and profile data within 7 days.
• Remove Social9 on the platform: use the "Remove access" path for that platform in section 2.2. Social9 can no longer publish to that account, and we delete its data within 30 days.
• Delete everything: delete your Social9 account (Account Settings → Delete Account), or follow our Data Deletion Instructions. You can also email support@social9.com from the email address on your account.

2.6 Google and YouTube

Social9 uses YouTube API Services to upload videos to YouTube on your behalf. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy. You can revoke Social9's access to your Google account at any time from the Google security settings page.

Social9's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the features you see in Social9 (publishing to YouTube and Google Business Profile, and showing your channel, locations and post metrics), and we do not transfer it to others except as needed to provide those features, to comply with the law, or as part of a merger or acquisition.

Social9 sets cookies on your device when you use our website and app, as described in section 9. We do not store or read information on your device through YouTube API Services.

2.7 Meta, TikTok, LinkedIn, X and Pinterest

Data we receive from Meta (Facebook, Instagram and Threads), TikTok, LinkedIn, X and Pinterest is processed only to provide the features described in section 2.2, under each platform's developer terms. We keep it only as long as needed for those features and delete it when you disconnect the account, revoke access, delete your Social9 account or ask us to delete it. Deletion is available to every user, whether or not they have a paid plan. If a platform asks us to delete or update data, we do so promptly.

3. How We Use Your Information

We use the information we collect for the following purposes:

Service Delivery:

• Provide, operate, and maintain our Services
• Process your inputs and generate AI-powered outputs
• Publish the posts you schedule to the social media accounts you connect
• Authenticate your identity and manage your account
• Process payments and manage subscriptions

Authentication and Security:

• Verify your identity when you sign in
• Maintain secure access to your account
• Detect and prevent fraudulent or unauthorized access
• Protect against account takeover and identity theft
• Comply with authentication provider requirements

Service Improvement:

• Analyze usage patterns to improve our Services
• Develop new features and functionality
• Fix bugs and troubleshoot issues
• Conduct research and analysis

Communication:

• Send transactional emails (receipts, confirmations, account alerts)
• Respond to your inquiries and support requests
• Send service updates and announcements
• Send marketing communications (with your consent, where required)

Legal and Security:

• Comply with legal obligations
• Enforce our Terms of Service
• Detect, prevent, and address fraud, abuse, and security issues
• Protect the rights, property, and safety of Social9 and our users

4. AI Data Processing

4.1 How We Process Your Content

Our Services use artificial intelligence to process your inputs and generate outputs. When you use our AI-powered features:

• Your inputs are sent to our servers and may be processed by third-party AI providers (Anthropic, OpenAI and Google, accessed directly or through OpenRouter) to generate outputs
• Processing is done in real-time to provide the Services
• We implement technical safeguards to protect your content during processing

4.2 AI Training

We do not use your personal inputs to train our AI models without your explicit consent. Your content is processed solely to provide the Services you requested.

We may use anonymized, aggregated data that cannot be linked back to you for:

• Improving our Services
• Developing new features
• Research and analysis

4.3 Third-Party AI Providers

Our AI processing may involve third-party providers. These providers:

• Process data according to their own privacy policies and terms
• Are contractually bound to maintain confidentiality
• May retain data for their operational purposes as described in their policies

5. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

5.1 Service Providers

We share information with third-party service providers who perform services on our behalf, including:

These providers are contractually obligated to use your information only for the purposes of providing services to us and in accordance with this Privacy Policy. The current list of providers that process customer personal data is on our Sub-processors page. Business customers are covered by our Data Processing Addendum.

5.2 Social Media Platforms You Connect

When you schedule a post, we send its content and media to the platform you chose, at the time you chose, using that platform's official API. Once published, the post is governed by that platform's terms and privacy policy. We share nothing else about you with these platforms.

5.3 Authentication Providers

When you use third-party authentication (Google, Apple, Facebook, LinkedIn, X, Phone/WhatsApp), certain information flows between us and these providers as necessary to authenticate your identity. This is governed by both this Privacy Policy and the respective provider's privacy policy.

5.4 Legal Requirements

We may disclose your information if required to do so by law or in response to:

• Valid legal processes (subpoenas, court orders, government requests)
• Requests from law enforcement agencies
• To protect our rights, privacy, safety, or property
• To protect against legal liability

5.5 Business Transfers

If Social9 is involved in a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on our website of any change in ownership or uses of your personal information.

5.6 With Your Consent

We may share your information for other purposes with your explicit consent.

6. Data Retention

6.1 Retention Periods

We retain your information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

6.2 Deletion

When you delete your account:

• Your profile and account information will be deleted within 90 days
• Your user content will be deleted within 30 days
• Certain information may be retained as required by law (billing records)
• Anonymized, aggregated data may be retained indefinitely
• Connections to third-party authentication providers will be severed, but you may need to revoke access separately through those providers

6.3 Third-Party Authentication Data

When you disconnect a third-party authentication provider or delete your account:

• We will delete the data we received from that provider
• We cannot delete data held by the third-party provider—you must manage that directly with them
• Some data may be retained for security, fraud prevention, or legal compliance

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

Technical Safeguards:

• Encryption of data in transit (TLS/SSL)
• Encryption of sensitive data at rest
• Secure password hashing
• Regular security assessments and penetration testing
• Multi-factor authentication support
• Secure token handling for third-party authentication

Authentication Security:

• OAuth 2.0 / OpenID Connect protocols for social logins
• Secure session management
• Automatic session expiration
• Brute force protection and rate limiting
• Suspicious activity detection

Organizational Safeguards:

• Access controls and authentication
• Employee training on data protection
• Incident response procedures
• Vendor security assessments

Limitations: No method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security. The security of your account also depends on maintaining the security of your third-party authentication accounts.

8. International Data Transfers

Social9 is based in the United States. If you are accessing our Services from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States and other countries where our servers and service providers are located.

8.1 Transfer Mechanisms

For transfers of personal data from the European Economic Area (EEA), United Kingdom, or Switzerland to the United States, we rely on:

• Standard Contractual Clauses approved by the European Commission
• Your explicit consent where applicable
• Other lawful transfer mechanisms as appropriate

8.2 Third-Party Authentication Providers

When you use third-party authentication services, your data may also be transferred internationally by those providers according to their own transfer mechanisms and privacy policies.

8.3 Adequate Protection

We ensure that any international transfers of personal data are subject to appropriate safeguards as required by applicable data protection laws.

9. Cookies and Tracking Technologies

9.1 Types of Cookies We Use

9.2 Third-Party Cookies

We may allow third-party service providers to place cookies on your device for analytics and advertising purposes. These third parties have their own privacy policies.

Authentication providers may also set cookies when you use social login features.

9.3 Managing Cookies

You can control cookies through your browser settings:

• Block all cookies
• Block third-party cookies
• Delete cookies when you close your browser
• Receive alerts before cookies are placed

Note: Disabling certain cookies may affect the functionality of our Services, including authentication features.

9.4 Do Not Track

The full list of cookies we use, with their purpose and duration, is in our Cookie Policy.

Our Services do not currently respond to "Do Not Track" signals. However, you can manage your tracking preferences through the cookie settings described above.

10. Your Rights and Choices

10.1 Account Controls

You can access, update, or delete your account information at any time through your account dashboard:

• Update profile information
• Change password
• Manage notification preferences
• Connect or disconnect third-party authentication providers
• Download your data
• Delete your account

10.2 Authentication Provider Connections

You can manage your connected authentication providers:

• View which providers are connected to your account
• Disconnect providers (note: you must maintain at least one login method)
• Add new authentication methods

To fully revoke access, you should also remove our application from your connected apps in each provider's settings.

10.3 Communication Preferences

You can opt out of marketing communications by:

• Clicking "unsubscribe" in any marketing email
• Updating your preferences in account settings
• Contacting us at support@social9.com

Note: You cannot opt out of transactional communications related to your account and subscription.

10.4 Data Portability

You may request a copy of your personal data in a structured, commonly used, machine-readable format.

11. Region-Specific Rights

11.1 European Economic Area, United Kingdom, and Switzerland (GDPR)

If you are located in the EEA, UK, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR). Our GDPR page explains our roles, legal bases and international transfers in more detail.

• Right to Access: You have the right to request access to your personal data and obtain a copy of the information we hold about you.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): You have the right to request deletion of your personal data when:
  • The data is no longer necessary for the purposes it was collected
  • You withdraw consent (where processing is based on consent)
  • You object to processing and there are no overriding legitimate grounds
  • The data has been unlawfully processed
  • Deletion is required to comply with a legal obligation
• Right to Restriction of Processing: You have the right to request restriction of processing in certain circumstances.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.
• Right to Object: You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on consent, you have the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
• Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority in your country of residence if you believe our processing of your personal data violates applicable law.

Legal Basis for Processing: We process your personal data based on the following legal grounds:

• Contract: Processing necessary to perform our contract with you (providing the Services)
• Legitimate Interests: Processing necessary for our legitimate business interests (improving Services, fraud prevention, security)
• Consent: Processing based on your consent (marketing communications, optional third-party authentication)
• Legal Obligation: Processing necessary to comply with legal requirements

Third-Party Authentication Under GDPR: When you choose to authenticate via third-party providers, this is based on your consent. You may withdraw this consent by disconnecting the provider from your account, though this may affect your ability to access our Services.

To exercise your GDPR rights, please contact us at support@social9.com with "Privacy Request" in the subject line.

11.2 California (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: You have the right to request information about:
  • Categories of personal information collected
  • Specific pieces of personal information collected
  • Categories of sources from which information is collected
  • Purposes for collecting or selling personal information
  • Categories of third parties with whom information is shared
• Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions.
• Right to Correct: You have the right to request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: You have the right to opt out of the sale or sharing of your personal information. We do not sell your personal information.
• Right to Limit Use of Sensitive Personal Information: You have the right to limit the use and disclosure of sensitive personal information.
• Right to Non-Discrimination: You have the right not to receive discriminatory treatment for exercising your CCPA/CPRA rights.

Categories of Personal Information Collected (Past 12 Months):

Verification: To protect your privacy, we may need to verify your identity before responding to your request. We may ask you to provide information that matches our records.

To exercise your CCPA/CPRA rights, please contact us at support@social9.com with "Privacy Request" in the subject line.

11.3 Other Jurisdictions

If you are located in other jurisdictions with data protection laws (including Brazil's LGPD, Canada's PIPEDA, Australia's Privacy Act, etc.), you may have similar rights under applicable local laws. Please contact us to exercise your rights.

12. Third-Party Authentication Disclaimer

12.1 No Control Over Third-Party Providers

We use third-party authentication providers for your convenience. However:

• We do not control these providers or their data practices
• We are not responsible for the availability, security, or functionality of these services
• We cannot guarantee the accuracy or completeness of information received from these providers
• Changes to these providers' terms, features, or data sharing practices may affect our Services

12.2 Your Responsibility

When using third-party authentication, you are responsible for:

• Maintaining the security of your accounts with these providers
• Reviewing and understanding the privacy policies and terms of these providers
• Managing your privacy settings with each provider
• Revoking access through the provider's settings if you no longer want to use their authentication

12.3 Provider Outages and Changes

We are not liable for:

• Outages or unavailability of third-party authentication providers
• Changes to authentication provider APIs or features
• Data breaches at third-party authentication providers
• Termination of your account with a third-party provider
• Loss of access to our Services due to issues with third-party authentication

12.4 Account Security

If you believe your account or any connected authentication provider has been compromised:

• Immediately change your passwords
• Revoke access to our application from the provider's settings
• Contact us at support@social9.com
• Contact the affected authentication provider

13. Children's Privacy

Our Services are not intended for individuals under the age of 18 (or under 16 in the European Union). We do not knowingly collect personal information from children.

If we learn that we have collected personal information from a child without verification of parental consent, we will take steps to delete that information promptly.

If you believe we may have collected information from a child, please contact us immediately at support@social9.com.

14. Third-Party Links and Services

Our Services may contain links to third-party websites, services, or applications. This Privacy Policy does not apply to those third-party services, and we are not responsible for their privacy practices.

We encourage you to review the privacy policies of any third-party services you access through our Services, including authentication providers.

15. Automated Decision-Making

15.1 How We Use Automated Processing

We may use automated systems for:

• Fraud detection and prevention
• Account security monitoring
• Usage limit enforcement
• Content moderation
• Service optimization

15.2 Your Rights

If you are subject to a decision based solely on automated processing that significantly affects you, you may have the right to:

• Request human review of the decision
• Express your point of view
• Contest the decision

To exercise these rights, contact us at support@social9.com.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons.

Notification of Changes:

• We will post the updated Privacy Policy on this page with a new "Last Updated" date
• For material changes, we will notify you by email and/or prominent notice on our Services before the changes become effective
• Your continued use of the Services after the effective date constitutes acceptance of the updated Privacy Policy

We encourage you to review this Privacy Policy periodically.

17. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Social9, Inc.
201 Spear St, San Francisco, CA 94105, United States

Email: support@social9.com (for privacy and data deletion requests, put "Privacy Request" in the subject line)

Support page: social9.com/support

Response Time: We aim to respond to all inquiries within 30 days. For GDPR and CCPA requests, we will respond within the timeframes required by applicable law.