You may object to processing based on legitimate interests at any time — see §10. You may withdraw consent at any time without affecting prior processing.

5. Connected social Channels

When you connect a Channel, you authorise us — through the platform’s own OAuth consent screen — to act on your behalf. The specific scopes are shown to you at the moment of connection and are the authoritative statement of what we can access.

Broadly, for the platforms we support (Facebook, Instagram, LinkedIn, Threads, TikTok, Google Business Profile), we may:

• read the connected account/page/location identity and profile;

• publish, schedule, and delete content you create in Sociali;

• read post performance, audience, and engagement metrics;

• read and, where you enable it, reply to comments and reviews.

What this means for third parties. Data about other people — commenters, reviewers, followers, and the aggregate audience data platforms return — flows into your workspace. You are the controller of that data. For Google Business Profile in particular, we store review author display names, profile photo URLs, and review text. You must have a lawful basis for that processing and must tell those individuals as your own privacy notice requires.

Disconnecting. Removing a Channel revokes our token and stops all further access. Data already retrieved remains in your workspace until deleted under §8.

Platform data policies. Our use of information received from these APIs also adheres to each platform’s developer and platform-data policies, including the Meta Platform Terms, LinkedIn API Terms, TikTok Developer Terms, and the Google API Services User Data Policy including its Limited Use requirements.

6. Who we share personal data with

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

We disclose personal data to:

1. Sub-processors — vendors who process data to help us run the Service. The current list, with each vendor’s purpose, data categories, and location, is published at https://sociali.ai/subprocessors. Each is bound by a written contract with confidentiality and security obligations at least as protective as ours.

2. Connected platforms you choose — content you schedule is transmitted to the Channels you connect, at your instruction.

3. Professional advisers — lawyers, auditors, accountants, insurers, under duty of confidence.

4. Corporate transactions — an acquirer or successor in a merger, acquisition, financing, or sale of assets, subject to this policy and with notice to you.

5. Authorities — where legally compelled. We will notify you of a request for your workspace data unless legally prohibited, and we will challenge overbroad or unlawful requests.

We do not permit our AI sub-processors to use your content to train their general-purpose models. This is contracted through zero-data-retention or no-training terms with the providers listed in the Sub-processors document.

7. International transfers

We are established in the United States and our infrastructure runs primarily in the United States (us-central1, and Vercel/Supabase US regions). If you are in the EEA, UK, or Switzerland, your personal data will be transferred to and processed in the United States and in other countries where our sub-processors operate.

For those transfers we rely on:

• the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two or Three as applicable, incorporated into our DPA;

• the UK International Data Transfer Addendum to the SCCs;

• the Swiss addendum, where relevant;

• supplementary technical and organisational measures described in our Security page.

[Consider self-certifying to the EU–US Data Privacy Framework; it simplifies enterprise EU sales.]

A copy of the transfer mechanism is available on request at privacy@sociali.ai.

[Decide the position to state on EU/UK data residency.]

8. Retention